Account Discovery: Local Account (T1087.001)

Tactic: Discovery · Platforms: ESXi, Linux, macOS, Windows

The interactive view maps 1 detection strategy, 1 mitigation, 18 threat groups, 45 software entries, 2 campaigns to this technique, alongside D3FEND countermeasures and data-component coverage.

Sub-technique of Account Discovery (T1087).

Overview

Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.

Commands such as net user and net localgroup of the Net utility and id and groups on macOS and Linux can list local users and groups. On Linux, local users can also be enumerated through the use of the /etc/passwd file. On macOS, the dscl . list /Users command can be used to enumerate local accounts. On ESXi servers, the `esxcli system account list` command can list local user accounts.

Explore

• Open T1087.001 in the interactive ATT&CK matrix
• ATT&CK Intelligence View guide
• Official MITRE ATT&CK entry for T1087.001
• Sigma detection rules for MITRE ATT&CK
• Built by Shahrukh Khan