Procedure examples

POWRUNER may collect local group information by running net localgroup administrators or a series of other commands on a victim.

Emissary has the capability to execute the command net localgroup administrators.

Gomir checks the effective group ID of its process when initially executed to determine if it is in group 0, denoting superuser privileges in Linux environments.

FlawedAmmyy enumerates the privilege level of the victim during the initial infection.

Kazuar gathers information about local groups and members.

Flagpro has been used to execute the net localgroup administrators command on a targeted system.

Exbyte checks whether the process is running with privileged local access during execution.

Epic gathers information on local group names.

Caterpillar WebShell can obtain a list of local groups of users from a system.

Sys10 collects the group name of the logged-in user and sends it to the C2.

Cobalt Strike can use net localgroup to list local groups on a system.

Kwampirs collects a list of users belonging to the local users and administrators groups with the commands net localgroup administrators and net localgroup users.

JPIN can obtain the permissions of the victim user.

LunarWeb can discover local group memberships.

QakBot can use net localgroup to enable discovery of local groups.

Helminth has checked the local administrators group.

OSInfo has enumerated the local administrators group.

Commands such as net group and net localgroup can be used in Net to gather information about and manipulate groups.

BloodHound can collect information about local groups and members.

SILENTTRINITY can obtain a list of local groups and members.

PoshC2 contains modules, such as Get-LocAdm for enumerating permission groups.