Forensia CTI Core

About

Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior. Commands such as <code>net user</code> and <code>net localgroup</code> of the Net utility and <code>id</code> and <code>groups</code> on macOS and Linux can list local users and groups. On Linux, local users can also be enumerated through the use of the <code>/etc/passwd</code> file. On macOS, the <code>dscl . list /Users</code> command can be used to enumerate local accounts. On ESXi servers, the `esxcli system account list` command can list local user accounts.

Platforms: ESXi, Linux, macOS, WindowsParent: T1087 Account DiscoveryMITRE ATT&CK ↗

Used by actors

18 known groups

G0004 Ke3chang G0006 APT1 G0010 Turla G0018 admin@338 G0022 APT3 G0027 Threat Group-3390 G0030 Lotus Blossom G0033 Poseidon Group G0049 OilRig G0050 APT32 G0096 APT41 G0114 Chimera G0117 Fox Kitten G1009 Moses Staff G1017 Volt Typhoon G1039 RedCurl G1044 APT42 G1051 Medusa Group

Software

45 malware/tools implement this

DuquNetGeminiDukeSHOTPUTEliseMis-TypeS-TypeEpicRemsecOSInfoPupyPowerSploitPUNCHBUGGYPOWERSTATSMURKYTOPKwampirsBankshotRATANKBAComnieInvisiMoleKazuarTrickBotAgent TeslaEmpirePoshC2USBferryPonyValakSoreFangBloodHoundBazarHyperStackBitPaymerP.A.S. WebshellStuxnetSMOKEDHAMMilanPikabotMgBotRaccoon StealerDUSTTRAPRedLine StealerQilinInvisibleFerretSystemBC

Corpus indicators tagged with this technique

100 indicators in the corpus carry T1087.001.

Indicator	Type	Family	Sev	Src
c46bac27b5ca151afabd22c5546f78ae2ae3a20d	hash	—	80	2
42692bd13333623e9085d0c1326574a3391efcbf18158bb04972103c9ee4a3b8	hash	—	80	3
84ad78b2bab946c3677fdc28ebd8a774	hash	—	80	3
b439749a581ac5a29b5c9d91fc092bf4ceaa76a4	hash	—	80	3
f694401d8e80bb0f672b1b30fd7b153a	hash	—	80	2
458653300b48c90a8659b9e9cadc13717bce42b6	hash	—	80	3
111e8abb4b8592172d597926f47f018c	hash	—	80	2
7b6e094d98eb3f695e5856db4d8d22e11898cec9	hash	—	80	2
99911fce9e0d697c99421b81e8fe2a04	hash	—	80	2
b1b7aaa5bd4408a4d3003a9fabcdd041	hash	—	80	3
4c71357de3c0b12094693ca6eff94cad	hash	—	80	2
efc71bd23572eec985a6d1bbf61308fd	hash	—	80	2
f8d93c1769e877aae7e7d5c289a467b5ae371c7a	hash	—	80	3
873f1277a42de5c82f869459e7fb7c94554a642b	hash	—	80	3
681075027553546c119ec447eb8df84633dcffce	hash	—	80	3
9c44bc9373377831c45dd0ac2661a28e	hash	—	80	3
f4d77958a12a0778283d3e679b24b18f82e332c4	hash	—	80	3
738d4398e7d11427051093ba8a6f37e51470795c	hash	—	80	2
b82936f37648518425c7d3cf9e09eaffa41d7cdb3840f6a40287e3a108880f7b	sha256	—	80	2
123e80a34508c4dede7cc70e76931fcc	hash	—	80	3
2654c08491a0f7c4a3dfc6282de5638b	hash	—	80	3
a1c3520282c81afabdefa4834b96563edf95c3c7	hash	—	80	2
625b6535321d58bb5c613e85332bf731	hash	—	80	3
3d00e34594dbaba266f301ca37246e06	hash	—	80	2
b8eed63ab9cbdca494f26a6f66bfd4a0a693b3f0	hash	—	80	3
e952c18272efa1c3d73d0a5381bcf443c02743fe	hash	—	80	3
f1551d3e5d144eef4e70a29dd3dc52fb22459d1f	hash	—	80	2
3ddd90b99ee7ac3ec39e1d22b67c257d273a0970	hash	—	80	2
00e195d94d3b1f7092eb9ed132f89d1b	hash	—	80	3
b42159d68ba58d7857c091b5acc59e30e50a854b15f7ce04b61ff6c11cdf0156	hash	—	80	3

Showing the top 30 by severity of 100.