Account Discovery: Local Account

admin@338 actors used the following commands following exploitation of a machine with LOWBALL malware to enumerate user accounts: net user >> %temp%\download net user /domain >> %temp%\download^[1]

Agent Tesla can collect account information from the victim’s machine.^[2]

APT1 used the commands net localgroup,net user, and net group to find accounts on the system.^[3]

APT3 has used a tool that can obtain info about local and global group users, power users, and administrators.^[4]

APT32 enumerated administrative users using the commands net localgroup administrators.^[5]

Bankshot gathers domain and account names/information through process monitoring.^[6]

Bazar can identify administrator accounts on an infected host.^[7]

BitPaymer can enumerate the sessions for each user logged onto the infected host.^[8]

BloodHound can identify users with local administrator rights.^[9]

Chimera has used net user for account discovery.^[10]

Comnie uses the net user command.^[11]

The discovery modules used with Duqu can collect information on accounts and permissions.^[12]

Elise executes net user after initial communication is made to the remote server.^[13]

Empire can acquire local and domain user account information.^[14]

Epic gathers a list of all user accounts, privilege classes, and time of last logon.^[15]

Fox Kitten has accessed ntuser.dat and UserClass.dat on compromised hosts.^[16]

GeminiDuke collects information on local user accounts from the victim.^[17]

HyperStack can enumerate all account names on a remote share.^[18]

InvisiMole has a command to list account information on the victim’s machine.^[19]

Kazuar gathers information on local groups and members on the victim’s machine.^[20]

Ke3chang performs account discovery using commands such as net localgroup administrators and net group "REDACTED" /domain on specific permissions groups.^[21]

Kwampirs collects a list of accounts with the command net users.^[22]

Mis-Type may create a file containing the results of the command cmd.exe /c net user {{Username}}.^[23]

MURKYTOP has the capability to retrieve information about users on remote hosts.^[24]

Commands under net user can be used in Net to gather information about and manipulate user accounts.^[25]

OilRig has run net user, net user /domain, net group "domain admins" /domain, and net group "Exchange Trusted Subsystem" /domain to get account listings on a victim.^[26]

OSInfo enumerates local and domain users^[4]

P.A.S. Webshell can display the /etc/passwd file on a compromised host.^[27]

Pony has used the NetUserEnum function to enumerate local accounts.^[28]

Poseidon Group searches for administrator accounts on both the local victim machine and the network.^[29]

PoshC2 can enumerate local and domain user account information.^[30]

PowerSploit's Get-ProcessTokenGroup Privesc-PowerUp module can enumerate all SIDs associated with its current token.^[31][32]

POWERSTATS can retrieve usernames from compromised hosts.^[33]

PUNCHBUGGY can gather user names.^[34]

Pupy uses PowerView and Pywerview to perform discovery commands such as net user, net group, net local group, etc.^[35]

RATANKBA uses the net user command.^[36]

Remsec can obtain a list of users.^[37]

S-Type runs the command net user on a victim. S-Type also runs tests to determine the privilege level of the compromised user.^[23]

SHOTPUT has a command to retrieve information about connected users.^[38]

SMOKEDHAM has used net.exe user and net.exe users to enumerate local accounts on a compromised host.^[39]

SoreFang can collect usernames from the local system via net.exe user.^[40]

Stuxnet enumerates user accounts of the local host.^[41]

Threat Group-3390 has used net user to conduct internal discovery of systems.^[42]

TrickBot collects the users of the system.^[43][44]

Turla has used net user to enumerate local accounts on the system.^[45][46]

USBferry can use net user to gather information about local accounts.^[47]

Valak has the ability to enumerate local admin accounts.^[48]

Prevent administrator accounts from being enumerated when an application is elevating through UAC since it can lead to the disclosure of account names. The Registry key is located at HKLM\ SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\EnumerateAdministrators. It can be disabled through GPO: Computer Configuration > [Policies] > Administrative Templates > Windows Components > Credential User Interface: Enumerate administrator accounts on elevation.^[49]