t1087-001-local-account

name	T1087.001_local-account
description	Adversaries may attempt to get a listing of local system accounts.
category	information-gathering
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1087.001","discovery","esxi","linux","macos","windows","sub-technique"]
technique_id	T1087.001
tactic	discovery
all_tactics	["discovery"]
platforms	["ESXi","Linux","macOS","Windows"]
mitre_url	https://attack.mitre.org/techniques/T1087/001
tech_stack	["esxi","linux","macos","windows"]
cwe_ids	["CWE-200"]
chains_with	["T1087","T1087.002","T1087.003","T1087.004"]
prerequisites	["T1087"]
severity_boost	{"T1087":"Chain with T1087 for deeper attack path","T1087.002":"Chain with T1087.002 for deeper attack path","T1087.003":"Chain with T1087.003 for deeper attack path"}

T1087.001 Local Account

Sub-technique of: T1087

High-Level Description

Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.

Commands such as net user and net localgroup of the Net utility and id and groups on macOS and Linux can list local users and groups. On Linux, local users can also be enumerated through the use of the /etc/passwd file. On macOS, the dscl . list /Users command can be used to enumerate local accounts. On ESXi servers, the esxcli system account list command can list local user accounts.

Kill Chain Phase

• Discovery (TA0007)

Platforms: ESXi, Linux, macOS, Windows

What to Check

• Identify if Local Account technique is applicable to target environment
• Check ESXi systems for indicators of Local Account
• Check Linux systems for indicators of Local Account
• Check macOS systems for indicators of Local Account
• Verify mitigations are bypassed or absent (1 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Enumerate all accounts (Local)

Enumerate all accounts by copying /etc/passwd to another file

Supported Platforms: linux

cat /etc/passwd > #{output_file}
cat #{output_file}

Atomic Test 2: View sudoers access

(requires root)

Supported Platforms: linux, macos Elevation Required: Yes