用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill t1087-001-local-account命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | T1087.001_local-account |
| description | Adversaries may attempt to get a listing of local system accounts. |
| category | information-gathering |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1087.001","discovery","esxi","linux","macos","windows","sub-technique"] |
| technique_id | T1087.001 |
| tactic | discovery |
| all_tactics | ["discovery"] |
| platforms | ["ESXi","Linux","macOS","Windows"] |
| mitre_url | https://attack.mitre.org/techniques/T1087/001 |
| tech_stack | ["esxi","linux","macos","windows"] |
| cwe_ids | ["CWE-200"] |
| chains_with | ["T1087","T1087.002","T1087.003","T1087.004"] |
| prerequisites | ["T1087"] |
| severity_boost | {"T1087":"Chain with T1087 for deeper attack path","T1087.002":"Chain with T1087.002 for deeper attack path","T1087.003":"Chain with T1087.003 for deeper attack path"} |
Sub-technique of: T1087
Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.
Commands such as net user and net localgroup of the Net utility and id and groups on macOS and Linux can list local users and groups. On Linux, local users can also be enumerated through the use of the /etc/passwd file. On macOS, the dscl . list /Users command can be used to enumerate local accounts. On ESXi servers, the esxcli system account list command can list local user accounts.
Platforms: ESXi, Linux, macOS, Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Enumerate all accounts by copying /etc/passwd to another file
Supported Platforms: linux
cat /etc/passwd > #{output_file}
cat #{output_file}
(requires root)
Supported Platforms: linux, macos Elevation Required: Yes
if [ -f /etc/sudoers ]; then sudo cat /etc/sudoers > #{output_file}; fi;
if [ -f /usr/local/etc/sudoers ]; then sudo cat /usr/local/etc/sudoers > #{output_file}; fi;
cat #{output_file}
View accounts with UID 0
Supported Platforms: linux, macos
grep 'x:0:' /etc/passwd > #{output_file}
grep '*:0:' /etc/passwd >> #{output_file}
cat #{output_file} 2>/dev/null
List opened files by user
Supported Platforms: linux, macos
username=$(id -u -n) && lsof -u $username
Dependencies:
Show if a user account has ever logged in remotely
Supported Platforms: linux
[ "$(uname)" = 'FreeBSD' ] && cmd="lastlogin" || cmd="lastlog"
$cmd > #{output_file}
cat #{output_file}
Dependencies:
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to Local Account by examining the target platforms (ESXi, Linux, macOS).
Assess Existing Defenses: Review whether mitigations for T1087.001 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Prevent administrator accounts from being enumerated when an application is elevating through UAC since it can lead to the disclosure of account names. The Registry key is located at HKLM\ SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\EnumerateAdministrators. It can be disabled through GPO: Computer Configuration > [Policies] > Administrative Templates > Windows Components > Credential User Interface: Enumerate administrator accounts on elevation.
| Finding | Severity | Impact |
|---|---|---|
| Local Account technique applicable | Low | Discovery |
| CWE ID | Title |
|---|---|
| CWE-200 | Exposure of Sensitive Information |