T1087.001 Local Account

T1087.001 Local Account

Sub-technique of: T1087

High-Level Description

Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.

Commands such as net user and net localgroup of the Net utility and id and groups on macOS and Linux can list local users and groups. On Linux, local users can also be enumerated through the use of the /etc/passwd file. On macOS, the dscl . list /Users command can be used to enumerate local accounts. On ESXi servers, the esxcli system account list command can list local user accounts.

Kill Chain Phase

• Discovery (TA0007)

Platforms: ESXi, Linux, macOS, Windows

What to Check

• Identify if Local Account technique is applicable to target environment
• Check ESXi systems for indicators of Local Account
• Check Linux systems for indicators of Local Account
• Check macOS systems for indicators of Local Account
• Verify mitigations are bypassed or absent (1 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Enumerate all accounts (Local)

Enumerate all accounts by copying /etc/passwd to another file

Supported Platforms: linux

cat /etc/passwd > #{output_file}
cat #{output_file}