Technique:  Account Discovery:Local Account
It actors used the following commands following exploitation of a machine with LOWBALL malware to enumerate user accounts: net user >> %temp%\download net user /domain >> %temp%\download
Agent Tesla can collect account information from the victim’s machine.
It used the commands net localgroup,net user, and net group to find accounts on the system.
It has used a tool that can obtain info about local and global group users, power users, and administrators.
It enumerated administrative users using the commands net localgroup administrators.
Bankshot gathers domain and account names/information through process monitoring.
Bazar can identify administrator accounts on an infected host.
BitPaymer can enumerate the sessions for each user logged onto the infected host.
BloodHound can identify users with local administrator rights.
It has used net user for account discovery.
Comnie uses the net user command.
The discovery modules used with Duqu can collect information on accounts and permissions.
Elise executes net user after initial communication is made to the remote server.
Empire can acquire local and domain user account information.
Epic gathers a list of all user accounts, privilege classes, and time of last logon.
It has accessed ntuser.dat and UserClass.dat on compromised hosts.
GeminiDuke collects information on local user accounts from the victim.
HyperStack can enumerate all account names on a remote share.
InvisiMole has a command to list account information on the victim’s machine.
Kazuar gathers information on local groups and members on the victim’s machine.
It performs account discovery using commands such as net localgroup administrators and net group "REDACTED" /domain on specific permissions groups.
Kwampirs collects a list of accounts with the command net users.
Milan has run C:\Windows\system32\cmd.exe /c cmd /c dir c:\users\ /s 2>&1 to discover local accounts.
Mis-Type may create a file containing the results of the command cmd.exe /c net user {Username}.
It has collected the administrator username from a compromised host.
MURKYTOP has the capability to retrieve information about users on remote hosts.
Commands under net user can be used in Net to gather information about and manipulate user accounts.
It has run net user, net user /domain, net group "domain admins" /domain, and net group "Exchange Trusted Subsystem" /domain to get account listings on a victim.
During Operation CuckooBees, the threat actors used the net user command to gather account information.
OSInfo enumerates local and domain users
P.A.S. Webshell can display the /etc/passwd file on a compromised host.
Pony has used the NetUserEnum function to enumerate local accounts.
It searches for administrator accounts on both the local victim machine and the network.
PoshC2 can enumerate local and domain user account information.
PowerSploit's Get-ProcessTokenGroup Privesc-PowerUp module can enumerate all SIDs associated with its current token.
POWERSTATS can retrieve usernames from compromised hosts.
PUNCHBUGGY can gather user names.
Pupy uses PowerView and Pywerview to perform discovery commands such as net user, net group, net local group, etc.
RATANKBA uses the net user command.
Remsec can obtain a list of users.
S-Type has run the command net user on a victim.
SHOTPUT has a command to retrieve information about connected users.
SMOKEDHAM has used net.exe user and net.exe users to enumerate local accounts on a compromised host.
SoreFang can collect usernames from the local system via net.exe user.
Stuxnet enumerates user accounts of the local host.
It has used net user to conduct internal discovery of systems.
TrickBot collects the users of the system.
It has used net user to enumerate local accounts on the system.
USBferry can use net user to gather information about local accounts.
Valak has the ability to enumerate local admin accounts.