title: Local Accounts Discovery
id: 502b42de-4306-40b4-9596-6f590c81f073
status: test
description: Local accounts, System Owner/User discovery using operating systems utilities
author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1033/T1033.md
date: 2019/10/21
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection_1:
    - Image|endswith: '\whoami.exe'
    - Image|endswith: '\wmic.exe'
      CommandLine|contains|all:
        - 'useraccount'
        - 'get'
    - Image|endswith:
        - '\quser.exe'
        - '\qwinsta.exe'
    - Image|endswith: '\cmdkey.exe'
      CommandLine|contains: '/list'
    - Image|endswith: '\cmd.exe'
      CommandLine|contains|all:
        - '/c'
        - 'dir '
        - '\Users\'
  filter_1:
    CommandLine|contains:
      - ' rmdir '             # don't match on 'dir'   "C:\Windows\System32\cmd.exe" /q /c rmdir /s /q "C:\Users\XX\AppData\Local\Microsoft\OneDrive\19.232.1124.0005"
  selection_2:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
    CommandLine|contains: 'user'
  filter_2:
    CommandLine|contains:
      - '/domain'             # local account discovery only
      - '/add'                # discovery only
      - '/delete'             # discovery only
      - '/active'             # discovery only
      - '/expires'            # discovery only
      - '/passwordreq'        # discovery only
      - '/scriptpath'         # discovery only
      - '/times'              # discovery only
      - '/workstations'       # discovery only
  condition: (selection_1 and not filter_1) or (selection_2 and not filter_2)
fields:
  - Image
  - CommandLine
  - User
  - LogonGuid
  - Hashes
  - ParentProcessGuid
  - ParentCommandLine
falsepositives:
  - Legitimate administrator or user enumerates local users for legitimate reason
level: low
tags:
  - attack.discovery
  - attack.t1033
  - attack.t1087.001
