value:  BitPaymer can enumerate the sessions for each user logged onto the infected host. ;; BloodHound can identify users with local administrator rights. ;; Chimera has used net user for account discovery. ;; Comnie uses the net user command. ;; The discovery modules used with Duqu can collect information on accounts and permissions. ;; Elise executes net user after initial communication is made to the remote server. ;; Empire can acquire local and domain user account information. ;; Epic gathers a list of all user accounts privilege classes and time of last logon. ;; Fox Kitten has accessed ntuser.dat and UserClass.dat on compromised hosts. ;; GeminiDuke collects information on local user accounts from the victim. ;; HyperStack can enumerate all account names on a remote share. ;; InvisiMole has a command to list account information on the victim’s machine. ;; Kazuar gathers information on local groups and members on the victim’s machine. ;; Ke3chang performs account discovery using commands such as net localgroup administrators and net group REDACTED" /domain on specific permissions groups. ;; Kwampirs collects a list of accounts with the command net users. ;; Mis-Type may create a file containing the results of the command cmd.exe /c net user {Username}. ;; MURKYTOP has the capability to retrieve information about users on remote hosts. ;; Commands under net user can be used in Net to gather information about and manipulate user accounts. ;; OilRig has run net user net user /domain net group “domain admins” /domain and net group “Exchange Trusted Subsystem” /domain to get account listings on a victim. ;; OSInfo enumerates local and domain users ;; P.A.S. Webshell can display the /etc/passwd file on a compromised host. ;; Pony has used the NetUserEnum function to enumerate local accounts. ;; Poseidon Group searches for administrator accounts on both the local victim machine and the network. ;; PoshC2 can enumerate local and domain user account information. ;; PowerSploit's Get-ProcessTokenGroup Privesc-PowerUp module can enumerate all SIDs associated with its current token. ;; POWERSTATS can retrieve usernames from compromised hosts. ;; PUNCHBUGGY can gather user names. ;; Pupy uses PowerView and Pywerview to perform discovery commands such as net user net group net local group etc. ;; RATANKBA uses the net user command. ;; Remsec can obtain a list of users. ;; S-Type runs the command net user on a victim. S-Type also runs tests to determine the privilege level of the compromised user. ;; SHOTPUT has a command to retrieve information about connected users. ;; SoreFang can collect usernames from the local system via net.exe user. ;; Threat Group-3390 has used net user to conduct internal discovery of systems. ;; TrickBot collects the users of the system. ;; Turla has used net user to enumerate local accounts on the system. ;; USBferry can use net user to gather information about local accounts. ;; Valak has the ability to enumerate local admin accounts."
name: Account Discovery: Local Account