Volt TyphoonG1017 ↗
Has run net localgroup administrators in compromised environments to enumerate accounts.1
tfMITRE ATT&CK sub-technique
Local Groups T1069.001
sub-technique of T1069 Permission Groups Discovery
- Tactic
- Discovery
- Platforms
- Linux, macOS, Windows
- Version
- 1.2
- Created
- 12 March 2020
- Last modified
- 12 May 2026
- Contributors
- Harshal Tupsamudre, Qualys; Miriam Wiesner, @miriamxyra, Microsoft Security
Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
7
Threat groupsTop 23%
Threat groups77th percentile · 77% of ATT&CK techniques have this many threat groups attributed or fewer.4
CampaignsTop 10%
Campaigns90th percentile · 90% of ATT&CK techniques have this many campaigns recorded or fewer.21
Tools & malwareTop 17%
Tools & malware83rd percentile · 83% of ATT&CK techniques have this many tools implementing them or fewer.30
Detection rulesTop 9%
Detection rules91st percentile · 91% of ATT&CK techniques have this many detection rules written or fewer.Local Groups MITRE reference T1069.001
Top 23%of all ATT&CK techniques for number of groups
7 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Tonto TeamG0131 ↗
Has used the ShowLocalGroupDetails command to identify administrator, user, and guest accounts on a compromised host.1
ChimeraG0114 ↗
Has used net localgroup administrators to identify accounts with local administrative rights.1
HEXANEG1001 ↗
Has run net localgroup to enumerate local groups.1
OilRigG0049 ↗
Has used net localgroup administrators to find local administrators on compromised systems.12
admin@338G0018 ↗
Actors used the following command following exploitation of a machine with LOWBALL malware to list local groups: net localgroup administrator >> %temp%\download1
All 7 groups for this technique · 6 newest in this preview
4 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Operation Digital EyeC0061 ↗
During Operation Digital Eye, threat actors used the local.exe tool to view group memberships.1
C0015C0015 ↗
During C0015, the threat actors used the command net localgroup "adminstrator" to identify accounts with local administrator rights.1
Operation CuckooBeesC0012 ↗
During Operation CuckooBees, the threat actors used the net group command as part of their advanced reconnaissance.1
Operation WocaoC0014 ↗
During Operation Wocao, threat actors used the command net localgroup administrators to list all administrators part of a local group.1
All 4 campaigns for this technique
21 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
GomirS1198 ↗
Checks the effective group ID of its process when initially executed to determine if it is in group 0, denoting superuser privileges in Linux environments.1
ExbyteS1179 ↗
Checks whether the process is running with privileged local access during execution.1
LunarWebS1141 ↗
Can discover local group memberships.1
FlagproS0696 ↗
Has been used to execute the net localgroup administrators command on a targeted system.1
SILENTTRINITYS0692 ↗
Can obtain a list of local groups and members.1
QakBotS0650 ↗
Can use net localgroup to enable discovery of local groups.12
All 21 software entries for this technique · 6 newest in this preview
Offense vs defense T1069.001
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 4Sigma rules (cumulative) · 16Splunk ESCU (cumulative) · 14
first rule: 2017 Q1 · 4 of 4 campaigns plottedLocal Groups detection strategy DET0114
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Behavioral Detection of Local Group Enumeration Across OS Platforms
3 platforms
AN0317 · Windows
Detects attempts to enumerate local groups via Net.exe, PowerShell, or native API calls that precede lateral movement or privilege abuse.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Security | EventCode=4688 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Time window between group enumeration and lateral movement or privilege escalation activity. |
| UserContext | Whether the process was executed by a privileged or low-privilege account. |
AN0318 · Linux
Detects enumeration of local groups using common binaries (groups, getent, cat /etc/group) or scripting with suspicious lineage.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ProcessName | Detection tuning for binaries like groups, getent, awk, or cut that may be used in pipelines. |
| ParentProcess | Used to determine whether enumeration was triggered by a script or terminal. |
AN0319 · macOS
Detects use of dscl or id/group commands to enumerate local system groups, often by post-exploitation tools or persistence checks.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | process:exec |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CommandLineContains | Match on specific dscl paths like '/Groups' or known enumeration options. |
| InteractiveSession | Used to scope out enumeration from user terminals versus background utilities. |
3 analytics
Certain commands are frequently used by malicious actors and infrequently used by normal users. By looking for execution of these commands in short periods of time, we can not only see when a malicious user was on the system but also get an idea of what they were doing.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PLA | Process Lineage Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| process | create | hostname |
| process | create | ppid |
| process | create | exe |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
processes = search Process:Create reg_processes = filter processes where (exe == "arp.exe" or exe == "at.exe" or exe == "attrib.exe" or exe == "cscript.exe" or exe == "dsquery.exe" or exe == "hostname.exe" or exe == "ipconfig.exe" or exe == "mimikatz.exe" or exe == "nbstat.exe" or exe == "net.exe" or exe == "netsh.exe" or exe == "nslookup.exe" or exe == "ping.exe" or exe == "quser.exe" or exe == "qwinsta.exe" or exe == "reg.exe" or exe == "runas.exe" or exe == "sc.exe" or exe == "schtasks.exe" or exe == "ssh.exe" or exe == "systeminfo.exe" or exe == "taskkill.exe" or exe == "telnet.exe" or exe == "tracert.exe" or exe == "wscript.exe" or exe == "xcopy.exe") reg_grouped = group reg by hostname, ppid where(max time between two events is 30 minutes) output reg_grouped
Sigma version of the above pseudocode, with some modifications.
DNIF version of the above pseudocode.
_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $App=regex(arp\.exe|at\.exe|attrib\.exe|cscript\.exe|dsquery\.exe|hostname\.exe|ipconfig\.exe|mimikatz.exe|nbstat\.exe|net\.exe|netsh\.exe|nslookup\.exe|ping\.exe|quser\.exe|qwinsta\.exe|reg\.exe|runas\.exe|sc\.exe|schtasks\.exe|ssh\.exe|systeminfo\.exe|taskkill\.exe|telnet\.exe|tracert\.exe|wscript\.exe|xcopy\.exe)i group count_unique $App limit 100 >>_agg count >>_checkif int_compare Count > 1 include
LogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=1 image IN ["*\arp.exe", "*\at.exe", "*\attrib.exe", "*\cscript.exe", "*\dsquery.exe", "*\hostname.exe", "*\ipconfig.exe", "*\mimikatz.exe", "*\nbstat.exe", "*\net.exe", "*\netsh.exe", "*\nslookup.exe", "*\ping.exe", "*\quser.exe", "*\qwinsta.exe", "*\reg.exe", "*\runas.exe", "*\sc.exe", "*\schtasks.exe", "*\ssh.exe", "*\systeminfo.exe", "*\taskkill.exe", "*\telnet.exe", "*\tracert.exe", "*\wscript.exe", "*\xcopy.exe"] | chart count() as cnt by host | search cnt > 1
Unit tests
CAR’s own validation procedures for this analytic.
Within a command window, execute several of the commands in quick succession.
["ipconfig /all","hostname","systeminfo","reg.exe Query HKLM\\Software\\Microsoft"]
When entering on a host for the first time, an adversary may try to discover information about the host. There are several built-in Windows commands that can be used to learn about the software configurations, active users, administrators, and networking configuration. These commands should be monitored to identify when an adversary is learning information about the system and environment. The information returned may impact choices an adversary can make when establishing persistence, escalating privileges, or moving laterally.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PSA | Process Spawn Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| process | create | command_line |
| process | create | exe |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
To be effective in deciphering malicious and benign activity, the full command line is essential. Similarly, having information about the parent process can help with making decisions and tuning to an environment.
process = search Process:Create info_command = filter process where ( exe == "hostname.exe" or exe == "ipconfig.exe" or exe == "net.exe" or exe == "quser.exe" or exe == "qwinsta.exe" or exe == "sc" and (command_line match " query" or command_line match " qc")) or exe == "systeminfo.exe" or exe == "tasklist.exe" or exe == "whoami.exe" ) output info_command
Splunk version of the above pseudocode search.
index=__your_sysmon_index__ EventCode=1 (Image="C:\\Windows\\*\\hostname.exe" OR Image="C:\\Windows\\*\\ipconfig.exe" OR Image="C:\\Windows\\*\\net.exe" OR Image="C:\\Windows\\*\\quser.exe" OR Image="C:\\Windows\\*\\qwinsta.exe" OR (Image="C:\\Windows\\*\\sc.exe" AND (CommandLine="* query *" OR CommandLine="* qc *")) OR Image="C:\\Windows\\*\\systeminfo.exe" OR Image="C:\\Windows\\*\\tasklist.exe" OR Image="C:\\Windows\\*\\whoami.exe")|stats values(Image) as "Images" values(CommandLine) as "Command Lines" by ComputerName
EQL version of the above pseudocode search.
process where subtype.create and (process_name == "hostname.exe" or process_name == "ipconfig.exe" or process_name == "net.exe" or process_name == "quser.exe" process_name == "qwinsta.exe" or process_name == "systeminfo.exe" or process_name == "tasklist.exe" or process_name == "whoami.exe" or (process_name == "sc.exe" and (command_line == "* query *" or command_line == "* qc *")))
LogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=1 (image in ["*\hostname.exe", "*\ipconfig.exe", "*\net.exe", "*\quser.exe", "*\qwinsta.exe", "*\systeminfo.exe", "*\tasklist.exe", "*\whoami.exe"] OR (image="*\sc.exe" command IN ["* query *", "* qc *"))
Cyber actors frequently enumerate local or domain permissions groups. The net utility is usually used for this purpose. This analytic looks for any instances of net.exe, which is not normally used for benign purposes, although system administrator actions may trigger false positives.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PSA | Process Spawn Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| process | create | exe |
| process | create | command_line |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
This is a pseudocode representation of the below splunk search.
processes = search Process:Create net_processes = filter processes where ( exe = "net.exe" AND ( command_line="*net* user*" OR command_line="*net* group*" OR command_line="*net* localgroup*" OR command_line="*get-localgroup*" OR command_line="*get-ADPrincipalGroupMembership*" ) output net_processes
Look for instances of net.exe
(index=__your_sysmon_index__ EventCode=1) Image="C:\\Windows\\System32\\net.exe" AND (CommandLine="* user*" OR CommandLine="* group*" OR CommandLine="* localgroup*" OR CommandLine="*get-localgroup*" OR CommandLine="*get-ADPrincipalGroupMembership*")
Look for instances of net.exe
norm_id=WindowsSysmon event_id=1 image="C:\Windows\System32\net.exe" (command="* user*" OR command="* group*" OR command="* localgroup*" OR command="*get-localgroup*" OR command="*get-ADPrincipalGroupMembership*")
Tests7ExecutorsPowerShell 3 · sh 2 · cmd 2Need elevation0 of 7Have prerequisites2Have cleanup2Platformslinux, macos, windows, containers
Tests from Atomic Red Team (MIT licence) · technique definition