T1087.001_local-account

T1087.001 Local Account

Sub-technique of: T1087

High-Level Description

Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.

Commands such as net user and net localgroup of the Net utility and id and groups on macOS and Linux can list local users and groups. On Linux, local users can also be enumerated through the use of the /etc/passwd file. On macOS, the dscl . list /Users command can be used to enumerate local accounts. On ESXi servers, the esxcli system account list command can list local user accounts.

Kill Chain Phase

• Discovery (TA0007)

Platforms: ESXi, Linux, macOS, Windows

What to Check

• Identify if Local Account technique is applicable to target environment
• Check ESXi systems for indicators of Local Account
• Check Linux systems for indicators of Local Account
• Check macOS systems for indicators of Local Account
• Verify mitigations are bypassed or absent (1 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Enumerate all accounts (Local)

Enumerate all accounts by copying /etc/passwd to another file

Supported Platforms: linux

cat /etc/passwd > #{output_file}
cat #{output_file}

Atomic Test 2: View sudoers access

(requires root)

Supported Platforms: linux, macos Elevation Required: Yes

if [ -f /etc/sudoers ]; then sudo cat /etc/sudoers > #{output_file}; fi;
if [ -f /usr/local/etc/sudoers ]; then sudo cat /usr/local/etc/sudoers > #{output_file}; fi;
cat #{output_file}

Atomic Test 3: View accounts with UID 0

View accounts with UID 0

Supported Platforms: linux, macos

grep 'x:0:' /etc/passwd > #{output_file}
grep '*:0:' /etc/passwd >> #{output_file}
cat #{output_file} 2>/dev/null

Atomic Test 4: List opened files by user

List opened files by user

Supported Platforms: linux, macos

username=$(id -u -n) && lsof -u $username

Dependencies:

• check if lsof exists

Atomic Test 5: Show if a user account has ever logged in remotely

Show if a user account has ever logged in remotely

Supported Platforms: linux

[ "$(uname)" = 'FreeBSD' ] && cmd="lastlogin" || cmd="lastlog"
$cmd > #{output_file}
cat #{output_file}

Dependencies:

• Check if lastlog command exists on the machine

Manual Testing

If Atomic Red Team tests are not applicable, manually verify the technique by:

1. Identify Attack Surface: Determine if the target environment is susceptible to Local Account by examining the target platforms (ESXi, Linux, macOS).

2. Assess Existing Defenses: Review whether mitigations for T1087.001 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

3. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

Remediation Guide

M1028 Operating System Configuration

Prevent administrator accounts from being enumerated when an application is elevating through UAC since it can lead to the disclosure of account names. The Registry key is located at HKLM\ SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\EnumerateAdministrators. It can be disabled through GPO: Computer Configuration > [Policies] > Administrative Templates > Windows Components > Credential User Interface: Enumerate administrator accounts on elevation.

Detection

Local Account Enumeration Across Host Platforms

Risk Assessment

CWE Categories

References

• id man page
• groups man page
• Mandiant APT1
• Crowdstrike Hypervisor Jackpotting Pt 2 2021
• Elastic - Koadiac Detection with EQL
• Atomic Red Team - T1087.001
• MITRE ATT&CK - T1087.001