ATT&CK

Threat actorsMITRE ATT&CK intrusion sets Malware & toolsSoftware families & tooling TechniquesTactics & techniques

ReportsPublished APT reporting SourcesEvery feed behind the archive

Developers

JSON APIFree CORS-enabled endpoints MCP serverModel Context Protocol access Source codeThis project on GitHub

Loading the archive…

Open Threat Intel Archive

Indicators are treated as facts and kept with their source_vendor, source URL, and dates; every feed is credited and redistribution-restricted feeds are flagged, not dropped. ATT&CK content is © MITRE, used under its terms. See NOTICE. The archive reports intelligence; it does not editorialize threat.

Indicators Actors Sources API GitHub

Open Threat Intel Archive

← Techniques

T1087.001sub-technique

Local Account

Tactics: discovery

Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior. Commands such as <code>net user</code> and <code>net localgroup</code> of the Net utility and <code>id</code> and <code>groups</code> on macOS and Linux can list local users and groups. On Linux, local users can also be enumerated through the use of the <code>/etc/passwd</code> file. On macOS, the <code>dscl. list /Users</code> command can be used to enumerate local accounts. On ESXi servers, the esxcli system account list command can list local user accounts.

MITRE ATT&CK ↗

Linked entities · 24

subtechnique-ofT1087Account Discovery uses byG0022APT3 uses byG0018admin@338 uses byG1017Volt Typhoon uses byG0096APT41 uses byG0050APT32 uses byG1009Moses Staff uses byG0049OilRig uses byG0004Ke3chang uses byG0006APT1 uses byG0010Turla uses byG0033Poseidon Group uses byG1039RedCurl uses byG0030Lotus Blossom uses byG0114Chimera uses byG1051Medusa Group uses byG1044APT42 uses byG0117Fox Kitten uses byG0027Threat Group-3390 uses byS0266TrickBot uses byS1145Pikabot uses byS0233MURKYTOP uses byS0603Stuxnet uses byS0049GeminiDuke