Procedure examples

APT3 has used a tool that can obtain info about local and global group users, power users, and administrators.

admin@338 actors used the following commands following exploitation of a machine with LOWBALL malware to enumerate user accounts: net user >> %temp%\download net user /domain >> %temp%\download

Volt Typhoon has executed `net user` and `quser` to enumerate local account information.

APT41 used built-in net commands to enumerate local administrator groups.

APT32 enumerated administrative users using the commands net localgroup administrators.

Moses Staff has collected the administrator username from a compromised host.

OilRig has run net user, net user /domain, net group “domain admins” /domain, and net group “Exchange Trusted Subsystem” /domain to get account listings on a victim.

Ke3chang performs account discovery using commands such as net localgroup administrators and net group "REDACTED" /domain on specific permissions groups.

APT1 used the commands net localgroup,net user, and net group to find accounts on the system.

Turla has used net user to enumerate local accounts on the system.

Poseidon Group searches for administrator accounts on both the local victim machine and the network.

RedCurl has collected information about local accounts.

Lotus Blossom has used commands such as `net` to profile local system users.

Chimera has used net user for account discovery.

Medusa Group has leveraged `net user` for account discovery.

APT42 has used the PowerShell-based POWERPOST script to collect local account names from the victim machine.

Fox Kitten has accessed ntuser.dat and UserClass.dat on compromised hosts.

Threat Group-3390 has used net user to conduct internal discovery of systems.