MITRE ATT&CK - Техника Локальная учетная запись

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

Account Discovery: Локальная учетная запись

Other sub-techniques of Account Discovery (4)

ID	Название
.001	Локальная учетная запись
.002	Доменная учетная запись
.003	Учетные записи эл. почты
.004	Облачная учетная запись

Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior. Commands such as net user and net localgroup of the Net utility and id and groupson macOS and Linux can list local users and groups. On Linux, local users can also be enumerated through the use of the /etc/passwd file. On macOS the dscl . list /Users command can be used to enumerate local accounts.

ID: T1087.001

Относится к технике: T1087

Тактика(-и): Discovery

Платформы: Linux, macOS, Windows

Источники данных: Command: Command Execution, File: File Access, Group: Group Enumeration, Process: OS API Execution, Process: Process Creation

Версия: 1.3

Дата создания: 21 Feb 2020

Последнее изменение: 25 Aug 2022

Название	Описание
Примеры процедур
USBferry	USBferry can use `net user` to gather information about local accounts.(Citation: TrendMicro Tropic Trooper May 2020)
Agent Tesla	Agent Tesla can collect account information from the victim’s machine.(Citation: DigiTrust Agent Tesla Jan 2017)
Kwampirs	Kwampirs collects a list of accounts with the command `net users`.(Citation: Symantec Orangeworm April 2018)
Ke3chang	Ke3chang performs account discovery using commands such as `net localgroup administrators` and `net group "REDACTED" /domain` on specific permissions groups.(Citation: Mandiant Operation Ke3chang November 2014)
Net	Commands under `net user` can be used in Net to gather information about and manipulate user accounts.(Citation: Savill 1999)
Moses Staff	Moses Staff has collected the administrator username from a compromised host.(Citation: Checkpoint MosesStaff Nov 2021)
PUNCHBUGGY	PUNCHBUGGY can gather user names.(Citation: Morphisec ShellTea June 2019)
POWERSTATS	POWERSTATS can retrieve usernames from compromised hosts.(Citation: FireEye MuddyWater Mar 2018)
Duqu	The discovery modules used with Duqu can collect information on accounts and permissions.(Citation: Symantec W32.Duqu)
GeminiDuke	GeminiDuke collects information on local user accounts from the victim.(Citation: F-Secure The Dukes)
OSInfo	OSInfo enumerates local and domain users(Citation: Symantec Buckeye)
SHOTPUT	SHOTPUT has a command to retrieve information about connected users.(Citation: Palo Alto CVE-2015-3113 July 2015)
OilRig	OilRig has run `net user`, `net user /domain`, `net group “domain admins” /domain`, and `net group “Exchange Trusted Subsystem” /domain` to get account listings on a victim.(Citation: Palo Alto OilRig May 2016)
PoshC2	PoshC2 can enumerate local and domain user account information.(Citation: GitHub PoshC2)
Comnie	Comnie uses the `net user` command.(Citation: Palo Alto Comnie)
APT32	APT32 enumerated administrative users using the commands `net localgroup administrators`.(Citation: Cybereason Cobalt Kitty 2017)
BloodHound	BloodHound can identify users with local administrator rights.(Citation: CrowdStrike BloodHound April 2018)
	During Operation CuckooBees, the threat actors used the `net user` command to gather account information.(Citation: Cybereason OperationCuckooBees May 2022)
TrickBot	TrickBot collects the users of the system.(Citation: S2 Grupo TrickBot June 2017)(Citation: Trend Micro Trickbot Nov 2018)
RATANKBA	RATANKBA uses the `net user` command.(Citation: RATANKBA)
Chimera	Chimera has used `net user` for account discovery.(Citation: NCC Group Chimera January 2021)
Turla	Turla has used `net user` to enumerate local accounts on the system.(Citation: ESET ComRAT May 2020)(Citation: ESET Crutch December 2020)
Fox Kitten	Fox Kitten has accessed ntuser.dat and UserClass.dat on compromised hosts.(Citation: CISA AA20-259A Iran-Based Actor September 2020)
Epic	Epic gathers a list of all user accounts, privilege classes, and time of last logon.(Citation: Kaspersky Turla Aug 2014)
SoreFang	SoreFang can collect usernames from the local system via `net.exe user`.(Citation: CISA SoreFang July 2016)
APT3	APT3 has used a tool that can obtain info about local and global group users, power users, and administrators.(Citation: Symantec Buckeye)
Remsec	Remsec can obtain a list of users.(Citation: Kaspersky ProjectSauron Technical Analysis)
Mis-Type	Mis-Type may create a file containing the results of the command `cmd.exe /c net user {Username}`.(Citation: Cylance Dust Storm)
Bankshot	Bankshot gathers domain and account names/information through process monitoring.(Citation: McAfee Bankshot)
InvisiMole	InvisiMole has a command to list account information on the victim’s machine.(Citation: ESET InvisiMole June 2018)
Milan	Milan has run `C:\Windows\system32\cmd.exe /c cmd /c dir c:\users\ /s 2>&1` to discover local accounts.(Citation: ClearSky Siamesekitten August 2021)
Threat Group-3390	Threat Group-3390 has used `net user` to conduct internal discovery of systems.(Citation: SecureWorks BRONZE UNION June 2017)
Stuxnet	Stuxnet enumerates user accounts of the local host.(Citation: Symantec W.32 Stuxnet Dossier)
PowerSploit	PowerSploit's `Get-ProcessTokenGroup` Privesc-PowerUp module can enumerate all SIDs associated with its current token.(Citation: GitHub PowerSploit May 2012)(Citation: PowerSploit Documentation)
Poseidon Group	Poseidon Group searches for administrator accounts on both the local victim machine and the network.(Citation: Kaspersky Poseidon Group)
Empire	Empire can acquire local and domain user account information.(Citation: Github PowerShell Empire)
Pupy	Pupy uses PowerView and Pywerview to perform discovery commands such as net user, net group, net local group, etc.(Citation: GitHub Pupy)
admin@338	admin@338 actors used the following commands following exploitation of a machine with LOWBALL malware to enumerate user accounts: `net user >> %temp%\download` `net user /domain >> %temp%\download`(Citation: FireEye admin@338)
HyperStack	HyperStack can enumerate all account names on a remote share.(Citation: Accenture HyperStack October 2020)
Elise	Elise executes `net user` after initial communication is made to the remote server.(Citation: Lotus Blossom Jun 2015)
Bazar	Bazar can identify administrator accounts on an infected host.(Citation: NCC Group Team9 June 2020)
APT1	APT1 used the commands `net localgroup`,`net user`, and `net group` to find accounts on the system.(Citation: Mandiant APT1)
BitPaymer	BitPaymer can enumerate the sessions for each user logged onto the infected host.(Citation: Crowdstrike Indrik November 2018)
Pony	Pony has used the `NetUserEnum` function to enumerate local accounts.(Citation: Malwarebytes Pony April 2016)
Valak	Valak has the ability to enumerate local admin accounts.(Citation: Cybereason Valak May 2020)
Kazuar	Kazuar gathers information on local groups and members on the victim’s machine.(Citation: Unit 42 Kazuar May 2017)
SMOKEDHAM	SMOKEDHAM has used `net.exe user` and `net.exe users` to enumerate local accounts on a compromised host.(Citation: FireEye SMOKEDHAM June 2021)
MURKYTOP	MURKYTOP has the capability to retrieve information about users on remote hosts.(Citation: FireEye Periscope March 2018)
P.A.S. Webshell	P.A.S. Webshell can display the /etc/passwd file on a compromised host.(Citation: ANSSI Sandworm January 2021)
S-Type	S-Type has run the command `net user` on a victim.(Citation: Cylance Dust Storm)

Контрмера	Описание
Контрмеры
Operating System Configuration	Make configuration changes related to the operating system or a common feature of the operating system that result in system hardening against techniques.

Обнаружение

System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell. Monitor for processes that can be used to enumerate user accounts, such as net.exe and net1.exe, especially when executed in quick succession.(Citation: Elastic - Koadiac Detection with EQL)

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.