T1069.001 Local Groups | DetectionCode

About this technique

Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group.

Commands such as net localgroup of the Net utility, dscl . -list /Groups on macOS, and groups on Linux can list local groups.

Detection rules30

Rules on DetectionCode tagged with T1069.001.

Sigma15

Rule	Level	Log source
BloodHound Collection Files	high	windows / file_event
HackTool - Bloodhound/Sharphound Execution	high	windows / process_creation
Malicious PowerShell Commandlets - PoshModule	high	windows / ps_module
Malicious PowerShell Commandlets - ProcessCreation	high	windows / process_creation
Malicious PowerShell Commandlets - ScriptBlock	high	windows / ps_script
Permission Check Via Accesschk.EXE	medium	windows / process_creation
AD Groups Or Users Enumeration Using PowerShell - PoshModule	low	windows / ps_module
AD Groups Or Users Enumeration Using PowerShell - ScriptBlock	low	windows / ps_script
Local Groups Discovery - Linux	low	linux / process_creation
Local Groups Reconnaissance Via Wmic.EXE	low	windows / process_creation
Suspicious Get Information for SMB Share	low	windows / ps_script
Suspicious Get Information for SMB Share - PowerShell Module	low	windows / ps_module
Suspicious Get Local Groups Information	low	windows / ps_module
Suspicious Get Local Groups Information - PowerShell	low	windows / ps_script
Local Groups Discovery - MacOs	informational	macos / process_creation

Splunk15

Rule	Type	Risk	Data source
Detect AzureHound Command-Line Arguments	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Detect AzureHound File Modifications	TTP	NULL	Sysmon EventID 11
Detect SharpHound Command-Line Arguments	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Detect SharpHound File Modifications	TTP	NULL	Sysmon EventID 11
Detect SharpHound Usage	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Get WMIObject Group Discovery	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Get WMIObject Group Discovery with Script Block Logging	Hunting	NULL	Powershell Script Block Logging 4104
Net Localgroup Discovery	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Network Traffic to Active Directory Web Services Protocol	Hunting	NULL	Sysmon EventID 3
PowerShell Get LocalGroup Discovery	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Powershell Get LocalGroup Discovery with Script Block Logging	Hunting	NULL	Powershell Script Block Logging 4104
Windows Admin Permission Discovery	Anomaly	NULL	Sysmon EventID 11
Windows Group Discovery Via Net	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows SOAPHound Binary Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Wmic Group Discovery	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2

Groups7

Software21

BloodHound Caterpillar WebShell Cobalt Strike Emissary Epic Exbyte Flagpro FlawedAmmyy Gomir Helminth JPIN Kazuar Kwampirs LunarWeb Net OSInfo PoshC2 POWRUNER QakBot SILENTTRINITY Sys10

Campaigns4

C0015 Operation CuckooBees Operation Digital Eye Operation Wocao

Procedure examples32

Groups7

Used by	Procedure example
Groupadmin@338	admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to list local groups: `net localgroup administrator >> %temp%\download` FireEye admin@338
GroupChimera	Chimera has used `net localgroup administrators` to identify accounts with local administrative rights. NCC Group Chimera January 2021
GroupHEXANE	HEXANE has run `net localgroup` to enumerate local groups. Kaspersky Lyceum October 2021
GroupOilRig	OilRig has used `net localgroup administrators` to find local administrators on compromised systems. Palo Alto OilRig May 2016 Symantec Crambus OCT 2023
GroupTonto Team	Tonto Team has used the `ShowLocalGroupDetails` command to identify administrator, user, and guest accounts on a compromised host. TrendMicro Tonto Team October 2020
GroupTurla	Turla has used `net localgroup` and `net localgroup Administrators` to enumerate group information, including members of the local administrators group. ESET ComRAT May 2020
GroupVolt Typhoon	Volt Typhoon has run `net localgroup administrators` in compromised environments to enumerate accounts. Joint Cybersecurity Advisory Volt Typhoon June 2023

Software21

Used by	Procedure example
ToolBloodHound	BloodHound can collect information about local groups and members. CrowdStrike BloodHound April 2018
MalwareCaterpillar WebShell	Caterpillar WebShell can obtain a list of local groups of users from a system. ClearSky Lebanese Cedar Jan 2021
MalwareCobalt Strike	Cobalt Strike can use `net localgroup` to list local groups on a system. Cobalt Strike Manual 4.3 November 2020
MalwareEmissary	Emissary has the capability to execute the command `net localgroup administrators`. Emissary Trojan Feb 2016
MalwareEpic	Epic gathers information on local group names. Kaspersky Turla Aug 2014
MalwareExbyte	Exbyte checks whether the process is running with privileged local access during execution. Microsoft BlackByte 2023
MalwareFlagpro	Flagpro has been used to execute the `net localgroup administrators` command on a targeted system. NTT Security Flagpro new December 2021
MalwareFlawedAmmyy	FlawedAmmyy enumerates the privilege level of the victim during the initial infection. Korean FSI TA505 2020 Proofpoint TA505 Mar 2018

View all 21 software examples

Campaigns4

Used by	Procedure example
CampaignC0015	During C0015, the threat actors used the command `net localgroup "adminstrator" ` to identify accounts with local administrator rights. DFIR Conti Bazar Nov 2021
CampaignOperation CuckooBees	During Operation CuckooBees, the threat actors used the `net group` command as part of their advanced reconnaissance. Cybereason OperationCuckooBees May 2022
CampaignOperation Digital Eye	During Operation Digital Eye, threat actors used the local.exe tool to view group memberships. sentinelone operationDigitalEye Dec 2024
CampaignOperation Wocao	During Operation Wocao, threat actors used the command `net localgroup administrators` to list all administrators part of a local group. FoxIT Wocao December 2019