Procedure examples

Azorult can recursively search for files in folders and collects files from the desktop with certain extensions.

BACKSPACE allows adversaries to search for files.

Zox can enumerate files on a compromised host.

UPPERCUT has the capability to gather the victim's current directory.

ADVSTORESHELL can list files and directories.

StrifeWater can enumerate files on a compromised host.

WarzoneRAT can enumerate directories on a compromise host.

SLOTHFULMEDIA can enumerate files and directories.

FALLCHILL can search files on a victim.

RemoteUtilities can enumerate files and directories on a target machine.

If executed with elevated privileges, Diskpart can list all volumes, including virtual disks.

Sliver can enumerate files on a target system.

SILENTTRINITY has several modules, such as `ls.py`, `pwd.py`, and `recentFiles.py`, to enumerate directories and files.

Empire includes various modules for finding files of interest on hosts and network shares.

PoshC2 can enumerate files on the local file system and includes a module for enumerating recently accessed files.

Rclone can list files and directories with the `ls`, `lsd`, and `lsl` commands.

TruffleHog has can browse and scan individual files and directories.

Remcos can search for files on the infected machine.

Imminent Monitor has a dynamic debugging feature to check whether it is located in the %TEMP% directory, otherwise it copies itself there.

Forfiles can be used to locate certain types of files/directories in a system.(ex: locate all files with a specific extension, name, and/or age)

cmd can be used to find files and directories with native functionality such as dir commands.

CrackMapExec can discover specified filetypes and log files on a targeted system.

Koadic can obtain a list of directories.

Pupy can walk through directories and recursively search for strings in files.

TeamPCP Cloud Stealer can identify files containing environment variables, SSH keys, cloud credentials, access tokens, and cryptocurrency wallets.

Mini Shai-Hulud has enumerated home directories, file paths and files associated with storing or containing credentials and other secrets.

CanisterWorm has discovered npm pathways and directories that frequently store .npmrc files to check for _authToken values.

ShinyHunters has checked mount points for Oracle PeopleSoft configurations and has checked the process scheduler configuration file psappsrv.cfg. Additionally, ShinyHunters has read WebLogic server XML configurations files (config.xml).

BADFLICK has searched for files on the infected host.

During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to query internal database user account tables to enumerate accounts and identify high-privilege accounts within compromised environments.

During the SolarWinds Compromise, APT29 obtained a list of users and their roles from an Exchange server using `Get-ManagementRoleAssignment`.

Scattered Spider has identified vSphere administrator accounts.

Aquatic Panda used the last command in Linux environments to identify recently logged-in users on victim machines.

FIN13 has enumerated all users and their roles from a victim's main treasury system.

Havoc can identify privileged user accounts on infected systems.

TONESHELL included functionality to retrieve a list of user accounts.

Woody RAT can identify administrator accounts on an infected machine.

XCSSET attempts to discover accounts from various locations such as a user's Evernote, AppleID, Telegram, Skype, and WeChat data.

ShimRatReporter listed all non-privileged and privileged accounts available on the machine.

During Operation Digital Eye, threat actors used the local.exe tool to view local account information.

During Operation CuckooBees, the threat actors used the `net user` command to gather account information.

APT3 has used a tool that can obtain info about local and global group users, power users, and administrators.

admin@338 actors used the following commands following exploitation of a machine with LOWBALL malware to enumerate user accounts: net user >> %temp%\download net user /domain >> %temp%\download

Volt Typhoon has executed `net user` and `quser` to enumerate local account information.

APT41 used built-in net commands to enumerate local administrator groups.

APT32 enumerated administrative users using the commands net localgroup administrators.

Moses Staff has collected the administrator username from a compromised host.

OilRig has run net user, net user /domain, net group “domain admins” /domain, and net group “Exchange Trusted Subsystem” /domain to get account listings on a victim.

Ke3chang performs account discovery using commands such as net localgroup administrators and net group "REDACTED" /domain on specific permissions groups.

APT1 used the commands net localgroup,net user, and net group to find accounts on the system.