Medusa GroupG1051 ↗
Has leveraged net user for account discovery.1
- Tactic
- Discovery
- Platforms
- ESXi, Linux, macOS, Windows
- Version
- 1.5
- Created
- 21 February 2020
- Last modified
- 12 May 2026
- Contributors
- Daniel Stepanic, Elastic; Miriam Wiesner, @miriamxyra, Microsoft Security
Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
18
Threat groupsTop 10%
Threat groups90th percentile · 90% of ATT&CK techniques have this many threat groups attributed or fewer.2
CampaignsTop 17%
Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.45
Tools & malwareTop 9%
Tools & malware91st percentile · 91% of ATT&CK techniques have this many tools implementing them or fewer.27
Detection rulesTop 10%
Detection rules90th percentile · 90% of ATT&CK techniques have this many detection rules written or fewer.Local Account MITRE reference T1087.001
Top 10%of all ATT&CK techniques for number of groups
18 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
APT42G1044 ↗
Has used the PowerShell-based POWERPOST script to collect local account names from the victim machine.1
RedCurlG1039 ↗
Volt TyphoonG1017 ↗
Has executed net user and quser to enumerate local account information.1
Moses StaffG1009 ↗
Has collected the administrator username from a compromised host.1
Fox KittenG0117 ↗
Has accessed ntuser.dat and UserClass.dat on compromised hosts.1
All 18 groups for this technique · 6 newest in this preview
2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Operation Digital EyeC0061 ↗
During Operation Digital Eye, threat actors used the local.exe tool to view local account information.1
Operation CuckooBeesC0012 ↗
During Operation CuckooBees, the threat actors used the net user command to gather account information.1
All 2 campaigns for this technique
45 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
SystemBCS9001 ↗
Has collected the Windows account username on the victim machine.1
InvisibleFerretS1245 ↗
Has queried the victim device using Python scripts to obtain the User and Hostname.12
QilinS1242 ↗
Can list all local users found on a targeted system.1
RedLine StealerS1240 ↗
Has collected account information from the victim’s machine.12
DUSTTRAPS1159 ↗
Can enumerate local user accounts.1
Raccoon StealerS1148 ↗
Checks the privileges of running processes to determine if the running user is equivalent to NT Authority\System.1
All 45 software entries for this technique · 6 newest in this preview
Offense vs defense T1087.001
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 2Sigma rules (cumulative) · 13Splunk ESCU (cumulative) · 14
first rule: 2017 Q1 · 2 of 2 campaigns plottedLocal Account detection strategy DET0303
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Local Account Enumeration Across Host Platforms
4 platforms
AN0846 · Windows
Adversary enumeration of local user accounts using Net.exe, WMI, or PowerShell.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CommandLinePattern | Detects variations of 'net user', 'net localgroup', 'Get-LocalUser'. |
| UserContext | Restrict monitoring to low-privileged or unexpected users executing enumeration. |
| TimeWindow | Tune for bursts of enumeration commands in short succession. |
AN0847 · Linux
Enumeration of local users or groups via file access (/etc/passwd) or commands like id, groups.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | linux:Sysmon | EventCode=1 |
| File AccessDC0055 | auditd:PATH | PATH |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AccessedFile | Monitors sensitive file access such as '/etc/passwd', '/etc/group'. |
| ExecutionScope | Restrict detection to user-initiated sessions or specific parent processes. |
AN0848 · macOS
Enumeration of macOS local users using dscl, id, dscacheutil, or /etc/passwd access.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | None |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CommandLine | Monitor dscl . list /Users, dscacheutil -q user, id -un. |
| InteractiveSession | Focus on enumeration from non-console users or untrusted apps. |
AN0849 · ESXi
Enumeration of local ESXi accounts using esxcli or vSphere API from unauthorized sessions.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account MetadataDC0013 | vpxd.log | vCenter Management |
| Process CreationDC0032 | esxi:shell | Shell Execution |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CommandPattern | Look for 'esxcli system account list' and API calls from unusual sources. |
| SessionType | Restrict detection to interactive sessions vs. maintenance/automation jobs. |
2 analytics
Certain commands are frequently used by malicious actors and infrequently used by normal users. By looking for execution of these commands in short periods of time, we can not only see when a malicious user was on the system but also get an idea of what they were doing.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PLA | Process Lineage Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| process | create | hostname |
| process | create | ppid |
| process | create | exe |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
processes = search Process:Create reg_processes = filter processes where (exe == "arp.exe" or exe == "at.exe" or exe == "attrib.exe" or exe == "cscript.exe" or exe == "dsquery.exe" or exe == "hostname.exe" or exe == "ipconfig.exe" or exe == "mimikatz.exe" or exe == "nbstat.exe" or exe == "net.exe" or exe == "netsh.exe" or exe == "nslookup.exe" or exe == "ping.exe" or exe == "quser.exe" or exe == "qwinsta.exe" or exe == "reg.exe" or exe == "runas.exe" or exe == "sc.exe" or exe == "schtasks.exe" or exe == "ssh.exe" or exe == "systeminfo.exe" or exe == "taskkill.exe" or exe == "telnet.exe" or exe == "tracert.exe" or exe == "wscript.exe" or exe == "xcopy.exe") reg_grouped = group reg by hostname, ppid where(max time between two events is 30 minutes) output reg_grouped
Sigma version of the above pseudocode, with some modifications.
DNIF version of the above pseudocode.
_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $App=regex(arp\.exe|at\.exe|attrib\.exe|cscript\.exe|dsquery\.exe|hostname\.exe|ipconfig\.exe|mimikatz.exe|nbstat\.exe|net\.exe|netsh\.exe|nslookup\.exe|ping\.exe|quser\.exe|qwinsta\.exe|reg\.exe|runas\.exe|sc\.exe|schtasks\.exe|ssh\.exe|systeminfo\.exe|taskkill\.exe|telnet\.exe|tracert\.exe|wscript\.exe|xcopy\.exe)i group count_unique $App limit 100 >>_agg count >>_checkif int_compare Count > 1 include
LogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=1 image IN ["*\arp.exe", "*\at.exe", "*\attrib.exe", "*\cscript.exe", "*\dsquery.exe", "*\hostname.exe", "*\ipconfig.exe", "*\mimikatz.exe", "*\nbstat.exe", "*\net.exe", "*\netsh.exe", "*\nslookup.exe", "*\ping.exe", "*\quser.exe", "*\qwinsta.exe", "*\reg.exe", "*\runas.exe", "*\sc.exe", "*\schtasks.exe", "*\ssh.exe", "*\systeminfo.exe", "*\taskkill.exe", "*\telnet.exe", "*\tracert.exe", "*\wscript.exe", "*\xcopy.exe"] | chart count() as cnt by host | search cnt > 1
Unit tests
CAR’s own validation procedures for this analytic.
Within a command window, execute several of the commands in quick succession.
["ipconfig /all","hostname","systeminfo","reg.exe Query HKLM\\Software\\Microsoft"]
When entering on a host for the first time, an adversary may try to discover information about the host. There are several built-in Windows commands that can be used to learn about the software configurations, active users, administrators, and networking configuration. These commands should be monitored to identify when an adversary is learning information about the system and environment. The information returned may impact choices an adversary can make when establishing persistence, escalating privileges, or moving laterally.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PSA | Process Spawn Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| process | create | command_line |
| process | create | exe |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
To be effective in deciphering malicious and benign activity, the full command line is essential. Similarly, having information about the parent process can help with making decisions and tuning to an environment.
process = search Process:Create info_command = filter process where ( exe == "hostname.exe" or exe == "ipconfig.exe" or exe == "net.exe" or exe == "quser.exe" or exe == "qwinsta.exe" or exe == "sc" and (command_line match " query" or command_line match " qc")) or exe == "systeminfo.exe" or exe == "tasklist.exe" or exe == "whoami.exe" ) output info_command
Splunk version of the above pseudocode search.
index=__your_sysmon_index__ EventCode=1 (Image="C:\\Windows\\*\\hostname.exe" OR Image="C:\\Windows\\*\\ipconfig.exe" OR Image="C:\\Windows\\*\\net.exe" OR Image="C:\\Windows\\*\\quser.exe" OR Image="C:\\Windows\\*\\qwinsta.exe" OR (Image="C:\\Windows\\*\\sc.exe" AND (CommandLine="* query *" OR CommandLine="* qc *")) OR Image="C:\\Windows\\*\\systeminfo.exe" OR Image="C:\\Windows\\*\\tasklist.exe" OR Image="C:\\Windows\\*\\whoami.exe")|stats values(Image) as "Images" values(CommandLine) as "Command Lines" by ComputerName
EQL version of the above pseudocode search.
process where subtype.create and (process_name == "hostname.exe" or process_name == "ipconfig.exe" or process_name == "net.exe" or process_name == "quser.exe" process_name == "qwinsta.exe" or process_name == "systeminfo.exe" or process_name == "tasklist.exe" or process_name == "whoami.exe" or (process_name == "sc.exe" and (command_line == "* query *" or command_line == "* qc *")))
LogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=1 (image in ["*\hostname.exe", "*\ipconfig.exe", "*\net.exe", "*\quser.exe", "*\qwinsta.exe", "*\systeminfo.exe", "*\tasklist.exe", "*\whoami.exe"] OR (image="*\sc.exe" command IN ["* query *", "* qc *"))
Prevent administrator accounts from being enumerated when an application is elevating through UAC since it can lead to the disclosure of account names. The Registry key is located at HKLM\ SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\EnumerateAdministrators. It can be disabled through GPO: Computer Configuration > [Policies] > Administrative Templates > Windows Components > Credential User Interface: Enumerate administrator accounts on elevation.
Tests11Executorssh 7 · cmd 3 · PowerShell 1Need elevation1 of 11Have prerequisites3Have cleanup4Platformslinux, macos, windows
| # | Test | Platform | Executor | Elevation | Prereqs | Cleanup | Ref | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 01 | Enumerate all accounts (Local) | linux | sh | — | — | Yes | ||||||||||||||||||||||
Enumerate all accounts by copying /etc/passwd to another file Input arguments
Attack command cat /etc/passwd > #{output_file}
cat #{output_file}
Cleanup command rm -f #{output_file}
GUIDa5bbddc4-4352-4ca4-bb0b-b42b2f944dc1 | ||||||||||||||||||||||||||||
| 02 | View sudoers access | linux, macos | sh | Required | — | Yes | ||||||||||||||||||||||
(requires root) Input arguments
Attack command if [ -f /etc/sudoers ]; then sudo cat /etc/sudoers > #{output_file}; fi;
if [ -f /usr/local/etc/sudoers ]; then sudo cat /usr/local/etc/sudoers > #{output_file}; fi;
cat #{output_file}
Cleanup command rm -f #{output_file}
GUID4537efb4-9bb0-4e30-a043-df3c4c3d6006 | ||||||||||||||||||||||||||||
| 03 | View accounts with UID 0 | linux, macos | sh | — | — | Yes | ||||||||||||||||||||||
View accounts with UID 0 Input arguments
Attack command grep 'x:0:' /etc/passwd > #{output_file}
grep '*:0:' /etc/passwd >> #{output_file}
cat #{output_file} 2>/dev/null
Cleanup command rm -f #{output_file} 2>/dev/null
GUID28817f61-d51c-4756-947a-c4e19664c2d1 | ||||||||||||||||||||||||||||
| 04 | List opened files by user | linux, macos | sh | — | 1 | — | ||||||||||||||||||||||
List opened files by user Attack command username=$(id -u -n) && lsof -u $username Prerequisite check if lsof exists Check which lsof Satisfy (which pkg && pkg install -y lsof)||(which yum && yum -y install lsof)||(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y lsof) GUID15311930-8bdd-4a4d-8e36-2a5706056f7f | ||||||||||||||||||||||||||||
| 05 | Show if a user account has ever logged in remotely | linux | sh | — | 1 | Yes | ||||||||||||||||||||||
Show if a user account has ever logged in remotely Input arguments
Attack command [ "$(uname)" = 'FreeBSD' ] && cmd="lastlogin" || cmd="lastlog"
$cmd > #{output_file}
cat #{output_file}
Cleanup command rm -f #{output_file}
Prerequisite Check if lastlog command exists on the machine Check if [ -x "$(command -v lastlog)" ]; then exit 0; else exit 1; fi Satisfy sudo apt-get install login; exit 1; GUID14341570-740b-41d8-b8da-a9b9488b4080 | ||||||||||||||||||||||||||||
| 06 | Enumerate users and groups | linux, macos | sh | — | — | — | ||||||||||||||||||||||
Utilize groups and id to enumerate users and groups Attack command groups id GUID98a7ec09-cb8e-406e-9ed9-5bd4b5481843 | ||||||||||||||||||||||||||||
| 07 | Enumerate users and groups | macos | sh | — | — | — | ||||||||||||||||||||||
Utilize local utilities to enumerate users and groups Attack command dscl . list /Groups dscl . list /Users dscl . list /Users | grep -v '_' dscacheutil -q group dscacheutil -q user GUID15e266c5-6771-4c13-812a-3db6ef7a7f20 | ||||||||||||||||||||||||||||
| 08 | Enumerate all accounts on Windows (Local) | windows | cmd | — | — | — | ||||||||||||||||||||||
Enumerate all accounts Upon execution, multiple enumeration commands will be run and their output displayed in the PowerShell session Attack command net user dir c:\Users\ cmdkey.exe /list net localgroup "Users" net localgroup GUIDde00547b-9fb9-49d0-b280-ec44dbd6cde2 | ||||||||||||||||||||||||||||
| 09 | Enumerate all accounts via PowerShell (Local) | windows | PowerShell | — | — | — | ||||||||||||||||||||||
Enumerate all accounts via PowerShell. Upon execution, lots of user account and group information will be displayed. Attack command net user get-localuser get-localgroupmember -group Users cmdkey.exe /list ls C:/Users get-childitem C:\Users\ dir C:\Users\ get-localgroup net localgroup GUID181b9c71-d9db-4fec-b0e6-3271d74c6388 | ||||||||||||||||||||||||||||
| 10 | Enumerate logged on users via CMD (Local) | windows | cmd | — | — | — | ||||||||||||||||||||||
Enumerate logged on users. Upon execution, logged on users will be displayed. Attack command query user GUID678dccca-e741-4829-9c63-18070735fb1e | ||||||||||||||||||||||||||||
| 11 | ESXi - Local Account Discovery via ESXCLI | windows | cmd | — | 1 | — | ||||||||||||||||||||||
An adversary can use ESXCLI to enumerate a list of all local accounts on an ESXi host. Reference" Input arguments
Attack command echo "" | "#{plink_file}" -batch "#{vm_host}" -ssh -l #{vm_user} -pw "#{vm_pass}" "esxcli system account list"
Prerequisite Check if we have plink Check if (Test-Path "#{plink_file}") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://the.earth.li/~sgtatham/putty/latest/w64/plink.exe" -OutFile "#{plink_file}"
GUID897697ad-0290-478c-892e-469254051669 | ||||||||||||||||||||||||||||
Tests from Atomic Red Team (MIT licence) · technique definition