T1087.001Discovery
Local Account
Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior. Commands such as net user and net localgroup of the Net utility and id and groups on macOS and Linux can list local users and groups. On Linux, local users can also be enumerated through the use of the /etc/passwd…
CVEs1
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.1
Reports0
Detections
13 Sigma rules tagged T1087.001Local AccountT1087.00113 general rules
- BloodHound Collection Fileshightest
- HackTool - Bloodhound/Sharphound Executionhightest
- Malicious PowerShell Commandlets - PoshModulehightest
- Malicious PowerShell Commandlets - ProcessCreationhightest
- Malicious PowerShell Commandlets - ScriptBlockhightest
- Suspicious Group And Account Reconnaissance Activity Using Net.EXEmediumtest
- Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdletmediumtest
- Suspicious Use of PsLogListmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Local Account
1 CVE, by priority. Each link shows its badge.- CVE-2023-27532Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function VulnerabilityVeeam · Backup & ReplicationKEVRansomwarePublic exploitHigh · 7.5T1133External Remote ServicesT1059.003Windows Command Shell+4 more · 1 reportMITRE CTID mapping of the KEV entry · follow-on activity80.6%Top 0.38%82.0priority