Cервис управления информационной безопасностью
Cервис управления информационной безопасностью
Вход Регистрация
MITRE ATT&CK - Техника Локальные группы
CVE уязвимости
БДУ ФСТЭК уязвимости
НКЦКИ уязвимости
MITRE ATT&CK
БДУ ФСТЭК
Новая БДУ ФСТЭК
EN
Риски
Каталоги
MITRE ATT&CK
Техника
Локальные группы
Куда я попал?
SECURITM это SGRC система, ? автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.
Подробнее
Наш канал

Permission Groups Discovery:  Локальные группы

ID Название
.001 Локальные группы
.002 Доменные группы
.003 Облачные группы

Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group. Commands such as net localgroup of the Net utility, dscl . -list /Groups on macOS, and groups on Linux can list local groups.

ID: T1069.001
Относится к технике:  T1069
Тактика(-и): Discovery
Платформы: Linux, macOS, Windows
Источники данных: Command: Command Execution, Group: Group Enumeration, Process: OS API Execution, Process: Process Creation
Версия: 1.2
Дата создания: 12 Mar 2020
Последнее изменение: 07 Apr 2023

Примеры процедур
Название Описание
Turla

Turla has used net localgroup and net localgroup Administrators to enumerate group information, including members of the local administrators group.(Citation: ESET ComRAT May 2020)
JPIN

JPIN can obtain the permissions of the victim user.(Citation: Microsoft PLATINUM April 2016)
Sys10

Sys10 collects the group name of the logged-in user and sends it to the C2.(Citation: Baumgartner Naikon 2015)
Operation Wocao

Operation Wocao has used the command net localgroup administrators to list all administrators part of a local group.(Citation: FoxIT Wocao December 2019)
BloodHound

BloodHound can collect information about local groups and members.(Citation: CrowdStrike BloodHound April 2018)
SILENTTRINITY

SILENTTRINITY can obtain a list of local groups and members.(Citation: GitHub SILENTTRINITY Modules July 2019)
Tonto Team

Tonto Team has used the ShowLocalGroupDetails command to identify administrator, user, and guest accounts on a compromised host.(Citation: TrendMicro Tonto Team October 2020)
POWRUNER

POWRUNER may collect local group information by running net localgroup administrators or a series of other commands on a victim.(Citation: FireEye APT34 Dec 2017)

During C0015, the threat actors used the command `net localgroup "adminstrator" ` to identify accounts with local administrator rights.(Citation: DFIR Conti Bazar Nov 2021)
HEXANE

HEXANE has run `net localgroup` to enumerate local groups.(Citation: Kaspersky Lyceum October 2021)

During Operation Wocao, threat actors used the command `net localgroup administrators` to list all administrators part of a local group.(Citation: FoxIT Wocao December 2019)
QakBot

QakBot can use net localgroup to enable discovery of local groups.(Citation: Kaspersky QakBot September 2021)(Citation: Trend Micro Black Basta October 2022)
Cobalt Strike

Cobalt Strike can use net localgroup to list local groups on a system.(Citation: Cobalt Strike Manual 4.3 November 2020)
Net

Commands such as net group and net localgroup can be used in Net to gather information about and manipulate groups.(Citation: Savill 1999)
PoshC2

PoshC2 contains modules, such as Get-LocAdm for enumerating permission groups.(Citation: GitHub PoshC2)
Kazuar

Kazuar gathers information about local groups and members.(Citation: Unit 42 Kazuar May 2017)
admin@338

admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to list local groups: net localgroup administrator >> %temp%\download(Citation: FireEye admin@338)
Emissary

Emissary has the capability to execute the command net localgroup administrators.(Citation: Emissary Trojan Feb 2016)
Flagpro

Flagpro has been used to execute the net localgroup administrators command on a targeted system.(Citation: NTT Security Flagpro new December 2021)

During Operation CuckooBees, the threat actors used the `net group` command as part of their advanced reconnaissance.(Citation: Cybereason OperationCuckooBees May 2022)
Chimera

Chimera has used net localgroup administrators to identify accounts with local administrative rights.(Citation: NCC Group Chimera January 2021)
Caterpillar WebShell

Caterpillar WebShell can obtain a list of local groups of users from a system.(Citation: ClearSky Lebanese Cedar Jan 2021)
LunarWeb

LunarWeb can discover local group memberships.(Citation: ESET Turla Lunar toolset May 2024)
Helminth

Helminth has checked the local administrators group.(Citation: Unit 42 Playbook Dec 2017)
Epic

Epic gathers information on local group names.(Citation: Kaspersky Turla Aug 2014)
OSInfo

OSInfo has enumerated the local administrators group.(Citation: Symantec Buckeye)
Volt Typhoon

Volt Typhoon has run `net localgroup administrators` in compromised environments to enumerate accounts.(Citation: Joint Cybersecurity Advisory Volt Typhoon June 2023)

OilRig

OilRig has used net localgroup administrators to find local administrators on compromised systems.(Citation: Palo Alto OilRig May 2016)
FlawedAmmyy

FlawedAmmyy enumerates the privilege level of the victim during the initial infection.(Citation: Proofpoint TA505 Mar 2018)(Citation: Korean FSI TA505 2020)
Kwampirs

Kwampirs collects a list of users belonging to the local users and administrators groups with the commands net localgroup administrators and net localgroup users.(Citation: Symantec Orangeworm April 2018)

Обнаружение

System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.

Ссылки

  1. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.
  2. Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.
  3. Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
  4. Baumgartner, K., Golovkin, M.. (2015, May). The MsnMM Campaigns: The Earliest Naikon APT Campaigns. Retrieved April 10, 2019.
  5. Red Team Labs. (2018, April 24). Hidden Administrative Accounts: BloodHound to the Rescue. Retrieved October 28, 2020.
  6. Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022.
  7. Daniel Lughi, Jaromir Horejsi. (2020, October 2). Tonto Team - Exploring the TTPs of an advanced threat actor operating a large infrastructure. Retrieved October 17, 2021.
  8. Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017.
  9. DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.
  10. Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022.
  11. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.
  12. Kuzmenko, A. et al. (2021, September 2). QakBot technical analysis. Retrieved September 27, 2021.
  13. Kenefick, I. et al. (2022, October 12). Black Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike. Retrieved February 6, 2023.
  14. Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021.
  15. Savill, J. (1999, March 4). Net.exe reference. Retrieved September 22, 2015.
  16. Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.
  17. Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.
  18. FireEye Threat Intelligence. (2015, December 1). China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets. Retrieved December 4, 2015.
  19. Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.
  20. Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.
  21. Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.
  22. Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024.
  23. ClearSky Cyber Security. (2021, January). “Lebanese Cedar” APT Global Lebanese Espionage Campaign Leveraging Web Servers. Retrieved February 10, 2021.
  24. Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.
  25. Unit 42. (2017, December 15). Unit 42 Playbook Viewer. Retrieved December 20, 2017.
  26. Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.
  27. Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.
  28. NSA et al. (2023, May 24). People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection. Retrieved July 27, 2023.
  29. Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.
  30. Proofpoint Staff. (2018, March 7). Leaked Ammyy Admin Source Code Turned into Malware. Retrieved May 28, 2019.
  31. Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
  32. Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.
Навигация

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.