T1087.001sub-technique of T1087 Account Discovery
Local Account
ESXi · Linux · macOS · Windowsnothing on this site yetT1087.001 on attack.mitre.org
Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior. Commands such as `net user` and `net localgroup` of the Net utility and `id` and `groups` on macOS and Linux can list local users and groups. On Linux, local users can also be enumerated through the use of the `/etc/passwd` file. On macOS, the `dscl.
how MITRE says to see it
Local Account Enumeration Across Host Platforms
- Adversary enumeration of local user accounts using Net.exe, WMI, or PowerShell.
- Enumeration of local users or groups via file access (/etc/passwd) or commands like id, groups.
- Enumeration of macOS local users using dscl, id, dscacheutil, or /etc/passwd access.
- Enumeration of local ESXi accounts using esxcli or vSphere API from unauthorized sessions.
what reduces it
- M1028 Operating System Configuration. Prevent administrator accounts from being enumerated when an application is elevating through UAC since it can lead to the disclosure of account names. The Registry key is located at `HKLM\ SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\EnumerateAdministrators`.