Skip to content

T1069.001 Local Groups

Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group.

Commands such as net localgroup of the Net utility, dscl . -list /Groups on macOS, and groups on Linux can list local groups.

Item Value
ID T1069.001
Sub-techniques T1069.001, T1069.002, T1069.003
Tactics TA0007
Platforms Linux, Windows, macOS
Permissions required User
Version 1.0
Created 12 March 2020
Last Modified 26 March 2020

Procedure Examples

ID Name Description
G0018 admin@338 admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to list local groups: net localgroup administrator >> %temp%\download24
S0521 BloodHound BloodHound can collect information about local groups and members.1
S0572 Caterpillar WebShell Caterpillar WebShell can obtain a list of local groups of users from a system.10
G0114 Chimera Chimera has used net localgroup administrators to identify accounts with local administrative rights.21
S0154 Cobalt Strike Cobalt Strike can use net localgroup to list local groups on a system.7
S0082 Emissary Emissary has the capability to execute the command net localgroup administrators.15
S0091 Epic Epic gathers information on local group names.11
S0696 Flagpro Flagpro has been used to execute the net localgroup administrators command on a targeted system.13
S0381 FlawedAmmyy FlawedAmmyy enumerates the privilege level of the victim during the initial infection.12
S0170 Helminth Helminth has checked the local administrators group.9
S0201 JPIN JPIN can obtain the permissions of the victim user.6
S0265 Kazuar Kazuar gathers information about local groups and members.5
S0236 Kwampirs Kwampirs collects a list of users belonging to the local users and administrators groups with the commands net localgroup administrators and net localgroup users.14
S0039 Net Commands such as net group and net localgroup can be used in Net to gather information about and manipulate groups.4
G0049 OilRig OilRig has used net localgroup administrators to find local administrators on compromised systems.23
G0116 Operation Wocao Operation Wocao has used the command net localgroup administrators to list all administrators part of a local group.20
S0165 OSInfo OSInfo has enumerated the local administrators group.16
S0378 PoshC2 PoshC2 contains modules, such as Get-LocAdm for enumerating permission groups.2
S0184 POWRUNER POWRUNER may collect local group information by running net localgroup administrators or a series of other commands on a victim.17
S0650 QakBot QakBot can use net localgroup to enable discovery of local groups.8
S0692 SILENTTRINITY SILENTTRINITY can obtain a list of local groups and members.3
S0060 Sys10 Sys10 collects the group name of the logged-in user and sends it to the C2.18
G0131 Tonto Team Tonto Team has used the ShowLocalGroupDetails command to identify administrator, user, and guest accounts on a compromised host.19
G0010 Turla Turla has used net localgroup and net localgroup Administrators to enumerate group information, including members of the local administrators group.22

Detection

ID Data Source Data Component
DS0017 Command Command Execution
DS0009 Process Process Creation

References

  1. Red Team Labs. (2018, April 24). Hidden Administrative Accounts: BloodHound to the Rescue. Retrieved October 28, 2020. ↩

  2. Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019. ↩

  3. Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022. ↩

  4. Savill, J. (1999, March 4). Net.exe reference. Retrieved September 22, 2015. ↩

  5. Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018. ↩

  6. Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018. ↩

  7. Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021. ↩

  8. Kuzmenko, A. et al. (2021, September 2). QakBot technical analysis. Retrieved September 27, 2021. ↩

  9. Unit 42. (2017, December 15). Unit 42 Playbook Viewer. Retrieved December 20, 2017. ↩

  10. ClearSky Cyber Security. (2021, January). “Lebanese Cedar” APT Global Lebanese Espionage Campaign Leveraging Web Servers. Retrieved February 10, 2021. ↩

  11. Kaspersky Lab’s Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018. ↩

  12. Proofpoint Staff. (2018, March 7). Leaked Ammyy Admin Source Code Turned into Malware. Retrieved May 28, 2019. ↩

  13. Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022. ↩

  14. Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018. ↩

  15. Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016. ↩

  16. Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016. ↩

  17. Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017. ↩

  18. Baumgartner, K., Golovkin, M.. (2015, May). The MsnMM Campaigns: The Earliest Naikon APT Campaigns. Retrieved April 10, 2019. ↩

  19. Daniel Lughi, Jaromir Horejsi. (2020, October 2). Tonto Team - Exploring the TTPs of an advanced threat actor operating a large infrastructure. Retrieved October 17, 2021. ↩

  20. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020. ↩

  21. Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved January 19, 2021. ↩

  22. Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020. ↩

  23. Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017. ↩

  24. FireEye Threat Intelligence. (2015, December 1). China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets. Retrieved December 4, 2015. ↩

Back to top