القائمة
Adversaries may attempt to get a listing of local system accounts.
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill t1087-001-local-accountيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
عرض SKILL.md
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
استنادا إلى تصنيف SOC المهني
| name | T1087.001_local-account |
| description | Adversaries may attempt to get a listing of local system accounts. |
| category | information-gathering |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1087.001","discovery","esxi","linux","macos","windows","sub-technique"] |
| technique_id | T1087.001 |
| tactic | discovery |
| all_tactics | ["discovery"] |
| platforms | ["ESXi","Linux","macOS","Windows"] |
| mitre_url | https://attack.mitre.org/techniques/T1087/001 |
| tech_stack | ["esxi","linux","macos","windows"] |
| cwe_ids | ["CWE-200"] |
| chains_with | ["T1087","T1087.002","T1087.003","T1087.004"] |
| prerequisites | ["T1087"] |
| severity_boost | {"T1087":"Chain with T1087 for deeper attack path","T1087.002":"Chain with T1087.002 for deeper attack path","T1087.003":"Chain with T1087.003 for deeper attack path"} |
Sub-technique of: T1087
Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.
Commands such as net user and net localgroup of the Net utility and id and groups on macOS and Linux can list local users and groups. On Linux, local users can also be enumerated through the use of the /etc/passwd file. On macOS, the dscl . list /Users command can be used to enumerate local accounts. On ESXi servers, the esxcli system account list command can list local user accounts.
Platforms: ESXi, Linux, macOS, Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Enumerate all accounts by copying /etc/passwd to another file
Supported Platforms: linux
cat /etc/passwd > #{output_file}
cat #{output_file}
(requires root)
Supported Platforms: linux, macos Elevation Required: Yes
if [ -f /etc/sudoers ]; then sudo cat /etc/sudoers > #{output_file}; fi;
if [ -f /usr/local/etc/sudoers ]; then sudo cat /usr/local/etc/sudoers > #{output_file}; fi;
cat #{output_file}
View accounts with UID 0
Supported Platforms: linux, macos
grep 'x:0:' /etc/passwd > #{output_file}
grep '*:0:' /etc/passwd >> #{output_file}
cat #{output_file} 2>/dev/null
List opened files by user
Supported Platforms: linux, macos
username=$(id -u -n) && lsof -u $username
Dependencies:
Show if a user account has ever logged in remotely
Supported Platforms: linux
[ "$(uname)" = 'FreeBSD' ] && cmd="lastlogin" || cmd="lastlog"
$cmd > #{output_file}
cat #{output_file}
Dependencies:
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to Local Account by examining the target platforms (ESXi, Linux, macOS).
Assess Existing Defenses: Review whether mitigations for T1087.001 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Prevent administrator accounts from being enumerated when an application is elevating through UAC since it can lead to the disclosure of account names. The Registry key is located at HKLM\ SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\EnumerateAdministrators. It can be disabled through GPO: Computer Configuration > [Policies] > Administrative Templates > Windows Components > Credential User Interface: Enumerate administrator accounts on elevation.
| Finding | Severity | Impact |
|---|---|---|
| Local Account technique applicable | Low | Discovery |
| CWE ID | Title |
|---|---|
| CWE-200 | Exposure of Sensitive Information |