1. Home
  2. Techniques
  3. Enterprise
  4. Permission Groups Discovery
  5. Local Groups

Permission Groups Discovery: Local Groups

ID Name
T1069.001 Local Groups
T1069.002 Domain Groups
T1069.003 Cloud Groups

Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group.

Commands such as net localgroup of the Net utility, dscl . -list /Groups on macOS, and groups on Linux can list local groups.

ID: T1069.001
Sub-technique of:  T1069
ⓘ
Tactic: Discovery
ⓘ
Platforms: Linux, Windows, macOS
Contributors: Harshal Tupsamudre, Qualys; Miriam Wiesner, @miriamxyra, Microsoft Security
Version: 1.2
Created: 12 March 2020
Last Modified: 07 April 2023
Version Permalink

Procedure Examples

ID Name Description
G0018 admin@338

admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to list local groups: net localgroup administrator >> %temp%\download[1]
S0521 BloodHound

BloodHound can collect information about local groups and members.[2]
C0015 C0015

During C0015, the threat actors used the command net localgroup "adminstrator" to identify accounts with local administrator rights.[3]
S0572 Caterpillar WebShell

Caterpillar WebShell can obtain a list of local groups of users from a system.[4]
G0114 Chimera

Chimera has used net localgroup administrators to identify accounts with local administrative rights.[5]
S0154 Cobalt Strike

Cobalt Strike can use net localgroup to list local groups on a system.[6]
S0082 Emissary

Emissary has the capability to execute the command net localgroup administrators.[7]
S0091 Epic

Epic gathers information on local group names.[8]
S0696 Flagpro

Flagpro has been used to execute the net localgroup administrators command on a targeted system.[9]
S0381 FlawedAmmyy

FlawedAmmyy enumerates the privilege level of the victim during the initial infection.[10][11]
S0170 Helminth

Helminth has checked the local administrators group.[12]
G1001 HEXANE

HEXANE has run net localgroup to enumerate local groups.[13]
S0201 JPIN

JPIN can obtain the permissions of the victim user.[14]
S0265 Kazuar

Kazuar gathers information about local groups and members.[15]
S0236 Kwampirs

Kwampirs collects a list of users belonging to the local users and administrators groups with the commands net localgroup administrators and net localgroup users.[16]
S1141 LunarWeb

LunarWeb can discover local group memberships.[17]
S0039 Net

Commands such as net group and net localgroup can be used in Net to gather information about and manipulate groups.[18]
G0049 OilRig

OilRig has used net localgroup administrators to find local administrators on compromised systems.[19]
C0012 Operation CuckooBees

During Operation CuckooBees, the threat actors used the net group command as part of their advanced reconnaissance.[20]
C0014 Operation Wocao

During Operation Wocao, threat actors used the command net localgroup administrators to list all administrators part of a local group.[21]
S0165 OSInfo

OSInfo has enumerated the local administrators group.[22]
S0378 PoshC2

PoshC2 contains modules, such as Get-LocAdm for enumerating permission groups.[23]
S0184 POWRUNER

POWRUNER may collect local group information by running net localgroup administrators or a series of other commands on a victim.[24]
S0650 QakBot

QakBot can use net localgroup to enable discovery of local groups.[25][26]
S0692 SILENTTRINITY

SILENTTRINITY can obtain a list of local groups and members.[27]
S0060 Sys10

Sys10 collects the group name of the logged-in user and sends it to the C2.[28]
G0131 Tonto Team

Tonto Team has used the ShowLocalGroupDetails command to identify administrator, user, and guest accounts on a compromised host.[29]
G0010 Turla

Turla has used net localgroup and net localgroup Administrators to enumerate group information, including members of the local administrators group.[30]
G1017 Volt Typhoon

Volt Typhoon has run net localgroup administrators in compromised environments to enumerate accounts.[31]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

ID Data Source Data Component Detects
DS0017 Command Command Execution

Monitor for executed commands and arguments that may attempt to find local system groups and permission settings.
DS0036 Group Group Enumeration

Monitor for logging that may suggest a list of available groups and/or their associated settings has been extracted, ex. Windows EID 4798 and 4799.
DS0009 Process OS API Execution

Monitor for API calls associated with finding local system groups and permission settings, such as NetLocalGroupEnum. Other API calls relevant to Local Group discovery include NetQueryDisplayInformation and NetGetDisplayInformationIndex.

Note: Most EDR tools do not support direct monitoring of API calls due to the sheer volume of calls produced by an endpoint but may have alerts or events that are based on abstractions of OS API calls. Dynamic malware analysis tools (i.e., sandboxes) can be used to trace the execution, including OS API calls, for a single PE binary.

Process Creation

Monitor newly executed processes that may attempt to find local system groups and permission settings.

Note: Event IDs are for Sysmon (Event ID 1 - process creation) and Windows Security Log (Event ID 4688 - a new process has been created). The logic in the Analytic looks for any instances of net.exe used for local user/group discovery; although this utility is not normally used for benign purposes, such usage by system administrator actions may trigger false positives.

Analytic 1 - Local Permission Group Discovery

(source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode="1") OR (source="WinEventLog:Security" EventCode="4688") Image="net.exe" AND ( CommandLine="net user" OR CommandLine="net group" OR CommandLine="net localgroup" OR CommandLine="get-localgroup" OR CommandLine="get-ADPrincipalGroupMembership*" )

References

  1. FireEye Threat Intelligence. (2015, December 1). China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets. Retrieved December 4, 2015.
  2. Red Team Labs. (2018, April 24). Hidden Administrative Accounts: BloodHound to the Rescue. Retrieved October 28, 2020.
  3. DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.
  4. ClearSky Cyber Security. (2021, January). “Lebanese Cedar” APT Global Lebanese Espionage Campaign Leveraging Web Servers. Retrieved February 10, 2021.
  5. Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024.
  6. Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021.
  7. Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.
  8. Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.
  9. Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.
  10. Proofpoint Staff. (2018, March 7). Leaked Ammyy Admin Source Code Turned into Malware. Retrieved May 28, 2019.
  11. Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
  12. Unit 42. (2017, December 15). Unit 42 Playbook Viewer. Retrieved December 20, 2017.
  13. Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022.
  14. Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
  15. Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.
  16. Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.
  1. Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.
  2. Savill, J. (1999, March 4). Net.exe reference. Retrieved September 22, 2015.
  3. Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.
  4. Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.
  5. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.
  6. Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.
  7. Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.
  8. Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017.
  9. Kuzmenko, A. et al. (2021, September 2). QakBot technical analysis. Retrieved September 27, 2021.
  10. Kenefick, I. et al. (2022, October 12). Black Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike. Retrieved February 6, 2023.
  11. Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022.
  12. Baumgartner, K., Golovkin, M.. (2015, May). The MsnMM Campaigns: The Earliest Naikon APT Campaigns. Retrieved April 10, 2019.
  13. Daniel Lughi, Jaromir Horejsi. (2020, October 2). Tonto Team - Exploring the TTPs of an advanced threat actor operating a large infrastructure. Retrieved October 17, 2021.
  14. Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.
  15. NSA et al. (2023, May 24). People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection. Retrieved July 27, 2023.