MITRE ATT&CKsub-technique

T1087.001 Local Account

Published 2020-02-21 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Discovery
Platforms
ESXi, Linux, macOS, Windows
Version
1.5
Created
2020-02-21

Description

Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior. Commands such as net user and net localgroup of the Net utility and id and groups on macOS and Linux can list local users and groups. On Linux, local users can also be enumerated through the use of the /etc/passwd file. On macOS, the dscl . list /Users command can be used to enumerate local accounts. On ESXi servers, the `esxcli system account list` command can list local user accounts.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1087 Account Discovery technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (1)

  • M1028 Operating System Configuration mitigation

Referenced by MITRE ATT&CK · uses (66)

  • G1059 NIMBUS MANTICORE group
  • C0061 Operation Digital Eye campaign
  • S9001 SystemBC software (malware)
  • S1245 InvisibleFerret software (malware)
  • G1051 Medusa Group group
  • S1242 Qilin software (malware)
  • S1240 RedLine Stealer software (malware)
  • G1044 APT42 group
  • G1039 RedCurl group
  • S1159 DUSTTRAP software (malware)
  • S1148 Raccoon Stealer software (malware)
  • S1146 MgBot software (malware)
  • S1145 Pikabot software (malware)
  • G1017 Volt Typhoon group
  • C0012 Operation CuckooBees campaign
  • G1009 Moses Staff group
  • S1015 Milan software (malware)
  • S0649 SMOKEDHAM software (malware)
  • S0598 P.A.S. Webshell software (malware)
  • S0570 BitPaymer software (malware)
  • G0117 Fox Kitten group
  • S0603 Stuxnet software (malware)
  • S0537 HyperStack software (malware)
  • S0534 Bazar software (malware)
  • S0521 BloodHound software (tool)
  • S0516 SoreFang software (malware)
  • G0114 Chimera group
  • S0476 Valak software (malware)
  • S0453 Pony software (malware)
  • S0452 USBferry software (malware)
Show all 66 ›

Referenced by Compliance · mitigates (3)

  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References