CmdID

CmdID / Techniques / T1087

T1087.001 Account Discovery: Local Account

Adversaries may attempt to get a listing of local system accounts. MITRE ATT&CK

9 Sigma rules T1087.001 on attack.mitre.org

Part of

MITRE ATT&CK
T1087Account Discovery

Sigma rules tagged with it

process creation, the highest levels first
highHackTool - Bloodhound/Sharphound ExecutionFlorian Roth (Nextron Systems) · Windows
highMalicious PowerShell Commandlets - ProcessCreationNasreddine Bencherchali (Nextron Systems) · Windows
mediumSuspicious Group And Account Reconnaissance Activity Using Net.EXEFlorian Roth (Nextron Systems), omkar72, @svch0st, Nasreddine Bencherchali (Nextron Systems) · Windows
mediumSuspicious Reconnaissance Activity Using Get-LocalGroupMember CmdletNasreddine Bencherchali (Nextron Systems) · Windows
mediumSuspicious Use of PsLogListNasreddine Bencherchali (Nextron Systems) · Windows
lowLocal Accounts DiscoveryTimur Zinniatullin, Daniil Yugoslavskiy, oscd.community · Windows
lowLocal System Accounts Discovery - MacOsAlejandro Ortuno, oscd.community · macOS
lowLocal System Accounts Discovery Attempt - LinuxAlejandro Ortuno, oscd.community, CheraghiMilad · Linux
lowNet.EXE ExecutionMichael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements) · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Display information about currently logged in users on the page for finger

fingerIdentify

Display information about a specific user on the page for finger

finger usernameIdentify

Display the user's login name, real name, terminal name, and other information on the page for finger

finger -sIdentify

View last login information (e.g., username, terminal, boot time, kernel) of all users as read from /var/log/wtmp on the page for last

List login information of a specific user on the page for last

last usernameIdentify

Specify how many of the last logins to show on the page for last

last --limit login_countIdentify

List last logged in users on the page for lastb

sudo lastbIdentify

List all last logged in users since a given time on the page for lastb

sudo lastb --since YYYY-MM-DDIdentify

List all last logged in users until a given time on the page for lastb

sudo lastb --until YYYY-MM-DDIdentify

Display current user's ID (UID), group ID (GID), and groups to which they belong on the page for id

Display the current user identity on the page for id

id --user --nameIdentify

Display the current user identity as a number on the page for id

id --userIdentify

And 39 more examples on CmdID’s program pages.

An example is here when CmdID’s reading of it names T1087.001: a Sigma rule it trips is tagged with it, or its abuse is documented as it.