Skip to content

T1069.001 Local Groups

Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group.

Commands such as net localgroup of the Net utility, dscl . -list /Groups on macOS, and groups on Linux can list local groups.

Item Value
ID T1069.001
Sub-techniques T1069.001, T1069.002, T1069.003
Tactics TA0007
Platforms Linux, Windows, macOS
Version 1.2
Created 12 March 2020
Last Modified 07 April 2023

Procedure Examples

ID Name Description
G0018 admin@338 admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to list local groups: net localgroup administrator >> %temp%\download24
S0521 BloodHound BloodHound can collect information about local groups and members.4
C0015 C0015 During C0015, the threat actors used the command net localgroup "adminstrator" to identify accounts with local administrator rights.28
S0572 Caterpillar WebShell Caterpillar WebShell can obtain a list of local groups of users from a system.19
G0114 Chimera Chimera has used net localgroup administrators to identify accounts with local administrative rights.25
S0154 Cobalt Strike Cobalt Strike can use net localgroup to list local groups on a system.5
S0082 Emissary Emissary has the capability to execute the command net localgroup administrators.14
S0091 Epic Epic gathers information on local group names.15
S0696 Flagpro Flagpro has been used to execute the net localgroup administrators command on a targeted system.13
S0381 FlawedAmmyy FlawedAmmyy enumerates the privilege level of the victim during the initial infection.1817
S0170 Helminth Helminth has checked the local administrators group.20
G1001 HEXANE HEXANE has run net localgroup to enumerate local groups.23
S0201 JPIN JPIN can obtain the permissions of the victim user.6
S0265 Kazuar Kazuar gathers information about local groups and members.7
S0236 Kwampirs Kwampirs collects a list of users belonging to the local users and administrators groups with the commands net localgroup administrators and net localgroup users.16
S0039 Net Commands such as net group and net localgroup can be used in Net to gather information about and manipulate groups.1
G0049 OilRig OilRig has used net localgroup administrators to find local administrators on compromised systems.22
C0012 Operation CuckooBees During Operation CuckooBees, the threat actors used the net group command as part of their advanced reconnaissance.29
C0014 Operation Wocao During Operation Wocao, threat actors used the command net localgroup administrators to list all administrators part of a local group.27
S0165 OSInfo OSInfo has enumerated the local administrators group.8
S0378 PoshC2 PoshC2 contains modules, such as Get-LocAdm for enumerating permission groups.2
S0184 POWRUNER POWRUNER may collect local group information by running net localgroup administrators or a series of other commands on a victim.10
S0650 QakBot QakBot can use net localgroup to enable discovery of local groups.1211
S0692 SILENTTRINITY SILENTTRINITY can obtain a list of local groups and members.3
S0060 Sys10 Sys10 collects the group name of the logged-in user and sends it to the C2.9
G0131 Tonto Team Tonto Team has used the ShowLocalGroupDetails command to identify administrator, user, and guest accounts on a compromised host.26
G0010 Turla Turla has used net localgroup and net localgroup Administrators to enumerate group information, including members of the local administrators group.21

Detection

ID Data Source Data Component
DS0017 Command Command Execution
DS0036 Group Group Enumeration
DS0009 Process OS API Execution

References

  1. Savill, J. (1999, March 4). Net.exe reference. Retrieved September 22, 2015. ↩

  2. Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019. ↩

  3. Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022. ↩

  4. Red Team Labs. (2018, April 24). Hidden Administrative Accounts: BloodHound to the Rescue. Retrieved October 28, 2020. ↩

  5. Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021. ↩

  6. Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018. ↩

  7. Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018. ↩

  8. Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016. ↩

  9. Baumgartner, K., Golovkin, M.. (2015, May). The MsnMM Campaigns: The Earliest Naikon APT Campaigns. Retrieved April 10, 2019. ↩

  10. Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017. ↩

  11. Kenefick, I. et al. (2022, October 12). Black Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike. Retrieved February 6, 2023. ↩

  12. Kuzmenko, A. et al. (2021, September 2). QakBot technical analysis. Retrieved September 27, 2021. ↩

  13. Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022. ↩

  14. Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016. ↩

  15. Kaspersky Lab’s Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018. ↩

  16. Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018. ↩

  17. Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022. ↩

  18. Proofpoint Staff. (2018, March 7). Leaked Ammyy Admin Source Code Turned into Malware. Retrieved May 28, 2019. ↩

  19. ClearSky Cyber Security. (2021, January). “Lebanese Cedar” APT Global Lebanese Espionage Campaign Leveraging Web Servers. Retrieved February 10, 2021. ↩

  20. Unit 42. (2017, December 15). Unit 42 Playbook Viewer. Retrieved December 20, 2017. ↩

  21. Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020. ↩

  22. Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017. ↩

  23. Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022. ↩

  24. FireEye Threat Intelligence. (2015, December 1). China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets. Retrieved December 4, 2015. ↩

  25. Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved January 19, 2021. ↩

  26. Daniel Lughi, Jaromir Horejsi. (2020, October 2). Tonto Team - Exploring the TTPs of an advanced threat actor operating a large infrastructure. Retrieved October 17, 2021. ↩

  27. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020. ↩

  28. DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022. ↩

  29. Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022. ↩