Local Account
Where this stands
One published detection covers this technique. Every one is unverified — no rule on Siemphony has been executed against real telemetry.
What the technique is
Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior. Commands such as net user and net localgroup of the Net utility and id and groups on macOS and Linux can list local users and groups. On Linux, local users can also be enumerated through the use of the /etc/passwd file. On macOS, the dscl. list /Users command can be used to enumerate local accounts. On ESXi servers, the esxcli system account list command can list local user accounts.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN0846
Adversary enumeration of local user accounts using Net.exe, WMI, or PowerShell.
- AN0847
Enumeration of local users or groups via file access (/etc/passwd) or commands like id, groups.
- AN0848
Enumeration of macOS local users using dscl, id, dscacheutil, or /etc/passwd access.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.