MITRE ATT&CK - Техника Локальные группы

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

Permission Groups Discovery: Локальные группы

Other sub-techniques of Permission Groups Discovery (3)

ID	Название
.001	Локальные группы
.002	Доменные группы
.003	Облачные группы

Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group. Commands such as net localgroup of the Net utility, dscl . -list /Groups on macOS, and groups on Linux can list local groups.

ID: T1069.001

Относится к технике: T1069

Тактика(-и): Discovery

Платформы: Linux, macOS, Windows

Источники данных: Command: Command Execution, Group: Group Enumeration, Process: OS API Execution, Process: Process Creation

Версия: 1.1

Дата создания: 12 Mar 2020

Последнее изменение: 25 Aug 2022

Название	Описание
Примеры процедур
Turla	Turla has used `net localgroup` and `net localgroup Administrators` to enumerate group information, including members of the local administrators group.(Citation: ESET ComRAT May 2020)
JPIN	JPIN can obtain the permissions of the victim user.(Citation: Microsoft PLATINUM April 2016)
Sys10	Sys10 collects the group name of the logged-in user and sends it to the C2.(Citation: Baumgartner Naikon 2015)
Operation Wocao	Operation Wocao has used the command `net localgroup administrators` to list all administrators part of a local group.(Citation: FoxIT Wocao December 2019)
BloodHound	BloodHound can collect information about local groups and members.(Citation: CrowdStrike BloodHound April 2018)
SILENTTRINITY	SILENTTRINITY can obtain a list of local groups and members.(Citation: GitHub SILENTTRINITY Modules July 2019)
Tonto Team	Tonto Team has used the `ShowLocalGroupDetails` command to identify administrator, user, and guest accounts on a compromised host.(Citation: TrendMicro Tonto Team October 2020)
POWRUNER	POWRUNER may collect local group information by running `net localgroup administrators` or a series of other commands on a victim.(Citation: FireEye APT34 Dec 2017)
	During C0015, the threat actors used the command `net localgroup "adminstrator" ` to identify accounts with local administrator rights.(Citation: DFIR Conti Bazar Nov 2021)
HEXANE	HEXANE has run `net localgroup` to enumerate local groups.(Citation: Kaspersky Lyceum October 2021)
	During Operation Wocao, threat actors used the command `net localgroup administrators` to list all administrators part of a local group.(Citation: FoxIT Wocao December 2019)
QakBot	QakBot can use `net localgroup` to enable discovery of local groups.(Citation: Kaspersky QakBot September 2021)
Cobalt Strike	Cobalt Strike can use `net localgroup` to list local groups on a system.(Citation: Cobalt Strike Manual 4.3 November 2020)
Net	Commands such as `net group` and `net localgroup` can be used in Net to gather information about and manipulate groups.(Citation: Savill 1999)
PoshC2	PoshC2 contains modules, such as `Get-LocAdm` for enumerating permission groups.(Citation: GitHub PoshC2)
Kazuar	Kazuar gathers information about local groups and members.(Citation: Unit 42 Kazuar May 2017)
admin@338	admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to list local groups: `net localgroup administrator >> %temp%\download`(Citation: FireEye admin@338)
Emissary	Emissary has the capability to execute the command `net localgroup administrators`.(Citation: Emissary Trojan Feb 2016)
Flagpro	Flagpro has been used to execute the `net localgroup administrators` command on a targeted system.(Citation: NTT Security Flagpro new December 2021)
	During Operation CuckooBees, the threat actors used the `net group` command as part of their advanced reconnaissance.(Citation: Cybereason OperationCuckooBees May 2022)
Chimera	Chimera has used `net localgroup administrators` to identify accounts with local administrative rights.(Citation: NCC Group Chimera January 2021)
Caterpillar WebShell	Caterpillar WebShell can obtain a list of local groups of users from a system.(Citation: ClearSky Lebanese Cedar Jan 2021)
Helminth	Helminth has checked the local administrators group.(Citation: Unit 42 Playbook Dec 2017)
Epic	Epic gathers information on local group names.(Citation: Kaspersky Turla Aug 2014)
OSInfo	OSInfo has enumerated the local administrators group.(Citation: Symantec Buckeye)
OilRig	OilRig has used `net localgroup administrators` to find local administrators on compromised systems.(Citation: Palo Alto OilRig May 2016)
FlawedAmmyy	FlawedAmmyy enumerates the privilege level of the victim during the initial infection.(Citation: Proofpoint TA505 Mar 2018)(Citation: Korean FSI TA505 2020)
Kwampirs	Kwampirs collects a list of users belonging to the local users and administrators groups with the commands `net localgroup administrators` and `net localgroup users`.(Citation: Symantec Orangeworm April 2018)

Обнаружение

System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.