Técnica MITRE ATT&CK · Descubrimiento

`T1087.001` Local Account

Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior. Commands such as net user and net localgroup of the [Net](https://attack.mitre.org/software/S0039) utility and id and groups on macOS and Linux can list local users and groups.(Citation: Mandiant APT1)(Citation: id…

Ficha en MITRE ATT&CK ↗

Quién la usa · con noticias en Jábega

Qilin

Reglas Sigma para cazarla

BloodHound Collection Fileshightest · windows
HackTool - Bloodhound/Sharphound Executionhightest · windows
Malicious PowerShell Commandlets - PoshModulehightest · windows
Malicious PowerShell Commandlets - ProcessCreationhightest · windows
Malicious PowerShell Commandlets - ScriptBlockhightest · windows
Suspicious Group And Account Reconnaissance Activity Using Net.EXEmediumtest · windows
Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdletmediumtest · windows
Suspicious Use of PsLogListmediumtest · windows

Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.