value:  Helminth has checked the local administrators group. ;; JPIN can obtain the permissions of the victim user. ;; Kazuar gathers information about local groups and members. ;; Kwampirs collects a list of users belonging to the local users and administrators groups with the commands net localgroup administrators and net localgroup users. ;; Commands such as net group and net localgroup can be used in Net to gather information about and manipulate groups. ;; OilRig has used net localgroup administrators to find local administrators on compromised systems. ;; Operation Wocao has used the command net localgroup administrators to list all administrators part of a local group. ;; OSInfo has enumerated the local administrators group. ;; PoshC2 contains modules such as Get-LocAdm for enumerating permission groups. ;; POWRUNER may collect local group information by running net localgroup administrators or a series of other commands on a victim. ;; Sys10 collects the group name of the logged-in user and sends it to the C2. ;; Turla has used net localgroup and net localgroup Administrators to enumerate group information including members of the local administrators group.
name: Permission Groups Discovery: Local Groups