Local Account discovery (T1087.001) is the sub-technique of Account Discovery that lists the accounts on a single system. It is a discovery technique for ESXi, Linux, macOS and Windows.
How attackers use it
MITRE says adversaries may list local system accounts to learn which ones exist and plan follow-on behavior. The page names the built-in commands:
- Windows: net user and net localgroup from the Net utility.
- Linux and macOS: id and groups.
- Linux: reading the /etc/passwd file.
- macOS: dscl . list /Users.
- ESXi: esxcli system account list.
How to detect it
MITRE's strategy (DET0303) lists:
- Windows: enumeration with Net.exe, WMI or PowerShell.
- Linux: reading /etc/passwd, or running id and groups.
- macOS: dscl, id, dscacheutil or /etc/passwd access.
- ESXi: esxcli or vSphere API calls from unauthorized sessions.
Command line logging is what makes these visible. Build a baseline for which tools and admin accounts normally run these commands, and alert on the rest, especially when several appear back to back.
How to reduce the risk
MITRE lists one mitigation, Operating System Configuration. Prevent administrator accounts from being enumerated when an application elevates through UAC, because it can disclose account names. The registry key is EnumerateAdministrators under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI, and group policy can control it under Credential User Interface.
Quick check
Which ESXi command does MITRE list for local account enumeration?
esxcli system account list.
Sources
- MITRE ATT&CK, T1087.001 Local Account: https://attack.mitre.org/techniques/T1087/001/
