Procedure examples

CanisterWorm has discovered npm pathways and directories that frequently store .npmrc files to check for _authToken values.

BADFLICK has searched for files on the infected host.

Havoc can identify privileged user accounts on infected systems.

TONESHELL included functionality to retrieve a list of user accounts.

Woody RAT can identify administrator accounts on an infected machine.

XCSSET attempts to discover accounts from various locations such as a user's Evernote, AppleID, Telegram, Skype, and WeChat data.

ShimRatReporter listed all non-privileged and privileged accounts available on the machine.

TrickBot collects the users of the system.

Pikabot will retrieve the name of the user associated with the thread under which the malware is executing.

MURKYTOP has the capability to retrieve information about users on remote hosts.

Stuxnet enumerates user accounts of the local host.

GeminiDuke collects information on local user accounts from the victim.

InvisibleFerret has queried the victim device using Python scripts to obtain the User and Hostname.

Bankshot gathers domain and account names/information through process monitoring.

Pony has used the NetUserEnum function to enumerate local accounts.

HyperStack can enumerate all account names on a remote share.

DUSTTRAP can enumerate local user accounts.

SystemBC has collected the Windows account username on the victim machine.

InvisiMole has a command to list account information on the victim’s machine.

P.A.S. Webshell can display the /etc/passwd file on a compromised host.

Kazuar gathers information on local groups and members on the victim’s machine.

SHOTPUT has a command to retrieve information about connected users.

PUNCHBUGGY can gather user names.

S-Type has run the command `net user` on a victim.

Remsec can obtain a list of users.

Epic gathers a list of all user accounts, privilege classes, and time of last logon.

Elise executes net user after initial communication is made to the remote server.

USBferry can use net user to gather information about local accounts.

SMOKEDHAM has used net.exe user and net.exe users to enumerate local accounts on a compromised host.

RedLine Stealer has collected account information from the victim’s machine.

Bazar can identify administrator accounts on an infected host.

RATANKBA uses the net user command.

MgBot includes modules for identifying local administrator accounts on victim systems.

Valak has the ability to enumerate local admin accounts.

Milan has run `C:\Windows\system32\cmd.exe /c cmd /c dir c:\users\ /s 2>&1` to discover local accounts.

Raccoon Stealer checks the privileges of running processes to determine if the running user is equivalent to `NT Authority\System`.

Kwampirs collects a list of accounts with the command net users.

Mis-Type may create a file containing the results of the command cmd.exe /c net user {Username}.

Qilin can list all local users found on a targeted system.

SoreFang can collect usernames from the local system via net.exe user.

Agent Tesla can collect account information from the victim’s machine.

POWERSTATS can retrieve usernames from compromised hosts.

Comnie uses the net user command.

OSInfo enumerates local and domain users

BitPaymer can enumerate the sessions for each user logged onto the infected host.

Commands under net user can be used in Net to gather information about and manipulate user accounts.

BloodHound can identify users with local administrator rights.

PowerSploit's Get-ProcessTokenGroup Privesc-PowerUp module can enumerate all SIDs associated with its current token.

Empire can acquire local and domain user account information.

PoshC2 can enumerate local and domain user account information.