Cервис управления информационной безопасностью
Cервис управления информационной безопасностью
Поиск
Вход Регистрация
MITRE ATT&CK - Техника Локальные группы
EN
Риски
Каталоги
MITRE ATT&CK
Техника
Локальные группы
Куда я попал?
SECURITM это SGRC система, ? автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.
Подробнее
Наш канал

Permission Groups Discovery:  Локальные группы

ID Название
.001 Локальные группы
.002 Доменные группы
.003 Облачные группы

Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group. Commands such as net localgroup of the Net utility, dscl . -list /Groups on macOS, and groups on Linux can list local groups.

ID: T1069.001
Относится к технике:  T1069
Тактика(-и): Discovery
Платформы: Linux, Windows, macOS
Источники данных: Command: Command Execution, Group: Group Enumeration, Process: OS API Execution, Process: Process Creation
Версия: 1.2
Дата создания: 12 Mar 2020
Последнее изменение: 15 Apr 2025

Примеры процедур
Название Описание
Net

Commands such as net group and net localgroup can be used in Net to gather information about and manipulate groups.(Citation: Savill 1999)
BloodHound

BloodHound can collect information about local groups and members.(Citation: CrowdStrike BloodHound April 2018)
POWRUNER

POWRUNER may collect local group information by running net localgroup administrators or a series of other commands on a victim.(Citation: FireEye APT34 Dec 2017)
Emissary

Emissary has the capability to execute the command net localgroup administrators.(Citation: Emissary Trojan Feb 2016)
SILENTTRINITY

SILENTTRINITY can obtain a list of local groups and members.(Citation: GitHub SILENTTRINITY Modules July 2019)
Gomir

Gomir checks the effective group ID of its process when initially executed to determine if it is in group 0, denoting superuser privileges in Linux environments.(Citation: Symantec Troll Stealer 2024)
FlawedAmmyy

FlawedAmmyy enumerates the privilege level of the victim during the initial infection.(Citation: Proofpoint TA505 Mar 2018)(Citation: Korean FSI TA505 2020)
PoshC2

PoshC2 contains modules, such as Get-LocAdm for enumerating permission groups.(Citation: GitHub PoshC2)
Kazuar

Kazuar gathers information about local groups and members.(Citation: Unit 42 Kazuar May 2017)
Flagpro

Flagpro has been used to execute the net localgroup administrators command on a targeted system.(Citation: NTT Security Flagpro new December 2021)
Exbyte

Exbyte checks whether the process is running with privileged local access during execution.(Citation: Microsoft BlackByte 2023)
Epic

Epic gathers information on local group names.(Citation: Kaspersky Turla Aug 2014)
Caterpillar WebShell

Caterpillar WebShell can obtain a list of local groups of users from a system.(Citation: ClearSky Lebanese Cedar Jan 2021)
Sys10

Sys10 collects the group name of the logged-in user and sends it to the C2.(Citation: Baumgartner Naikon 2015)
Cobalt Strike

Cobalt Strike can use net localgroup to list local groups on a system.(Citation: Cobalt Strike Manual 4.3 November 2020)
Kwampirs

Kwampirs collects a list of users belonging to the local users and administrators groups with the commands net localgroup administrators and net localgroup users.(Citation: Symantec Orangeworm April 2018)
JPIN

JPIN can obtain the permissions of the victim user.(Citation: Microsoft PLATINUM April 2016)
LunarWeb

LunarWeb can discover local group memberships.(Citation: ESET Turla Lunar toolset May 2024)
QakBot

QakBot can use net localgroup to enable discovery of local groups.(Citation: Kaspersky QakBot September 2021)(Citation: Trend Micro Black Basta October 2022)
Helminth

Helminth has checked the local administrators group.(Citation: Unit 42 Playbook Dec 2017)
OSInfo

OSInfo has enumerated the local administrators group.(Citation: Symantec Buckeye)
Turla

Turla has used net localgroup and net localgroup Administrators to enumerate group information, including members of the local administrators group.(Citation: ESET ComRAT May 2020)
Operation Wocao

Operation Wocao has used the command net localgroup administrators to list all administrators part of a local group.(Citation: FoxIT Wocao December 2019)
OilRig

OilRig has used net localgroup administrators to find local administrators on compromised systems.(Citation: Palo Alto OilRig May 2016)(Citation: Symantec Crambus OCT 2023)

Chimera

Chimera has used net localgroup administrators to identify accounts with local administrative rights.(Citation: NCC Group Chimera January 2021)
HEXANE

HEXANE has run `net localgroup` to enumerate local groups.(Citation: Kaspersky Lyceum October 2021)
Volt Typhoon

Volt Typhoon has run `net localgroup administrators` in compromised environments to enumerate accounts.(Citation: Joint Cybersecurity Advisory Volt Typhoon June 2023)

Tonto Team

Tonto Team has used the ShowLocalGroupDetails command to identify administrator, user, and guest accounts on a compromised host.(Citation: TrendMicro Tonto Team October 2020)
admin@338

admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to list local groups: net localgroup administrator >> %temp%\download(Citation: FireEye admin@338)

Обнаружение

System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.

Ссылки

  1. Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.
  2. Savill, J. (1999, March 4). Net.exe reference. Retrieved September 22, 2015.
  3. Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022.
  4. Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.
  5. Kenefick, I. et al. (2022, October 12). Black Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike. Retrieved February 6, 2023.
  6. ClearSky Cyber Security. (2021, January). “Lebanese Cedar” APT Global Lebanese Espionage Campaign Leveraging Web Servers. Retrieved February 10, 2021.
  7. Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
  8. DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.
  9. Proofpoint Staff. (2018, March 7). Leaked Ammyy Admin Source Code Turned into Malware. Retrieved May 28, 2019.
  10. Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022.
  11. Daniel Lughi, Jaromir Horejsi. (2020, October 2). Tonto Team - Exploring the TTPs of an advanced threat actor operating a large infrastructure. Retrieved October 17, 2021.
  12. Unit 42. (2017, December 15). Unit 42 Playbook Viewer. Retrieved December 20, 2017.
  13. Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017.
  14. Symantec Threat Hunter Team. (2024, May 16). Springtail: New Linux Backdoor Added to Toolkit. Retrieved January 17, 2025.
  15. Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.
  16. Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021.
  17. Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.
  18. Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.
  19. FireEye Threat Intelligence. (2015, December 1). China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets. Retrieved December 4, 2015.
  20. Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
  21. NSA et al. (2023, May 24). People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection. Retrieved July 27, 2023.
  22. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.
  24. Red Team Labs. (2018, April 24). Hidden Administrative Accounts: BloodHound to the Rescue. Retrieved October 28, 2020.
  25. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.
  26. Baumgartner, K., Golovkin, M.. (2015, May). The MsnMM Campaigns: The Earliest Naikon APT Campaigns. Retrieved April 10, 2019.
  27. Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.
  28. Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.
  29. Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.
  30. Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.
  31. Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024.
  32. Symantec Threat Hunter Team. (2023, October 19). Crambus: New Campaign Targets Middle Eastern Government. Retrieved November 27, 2024.
  33. Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.
  34. Kuzmenko, A. et al. (2021, September 2). QakBot technical analysis. Retrieved September 27, 2021.
  35. Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024.
  36. Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.
Навигация

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.