1. Home
  2. Techniques
  3. Enterprise
  4. Permission Groups Discovery
  5. Local Groups

Permission Groups Discovery: Local Groups

ID Name
T1069.001 Local Groups
T1069.002 Domain Groups
T1069.003 Cloud Groups

Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group.

Commands such as net localgroup of the Net utility, dscl . -list /Groups on macOS, and groups on Linux can list local groups.

ID: T1069.001
Sub-technique of:  T1069
ⓘ
Tactic: Discovery
ⓘ
Platforms: Linux, Windows, macOS
ⓘ
Permissions Required: User
Version: 1.0
Created: 12 March 2020
Last Modified: 26 March 2020
Provided by LAYER 8

Procedure Examples

ID Name Description
G0018 admin@338

admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to list local groups: net localgroup administrator >> %temp%\download[1]
S0521 BloodHound

BloodHound can collect information about local groups and members.[2]
S0572 Caterpillar WebShell

Caterpillar WebShell can obtain a list of local groups of users from a system.[3]
G0114 Chimera

Chimera has used net localgroup administrators to identify accounts with local administrative rights.[4]
S0154 Cobalt Strike

Cobalt Strike can use net localgroup to list local groups on a system.[5]
S0082 Emissary

Emissary has the capability to execute the command net localgroup administrators.[6]
S0091 Epic

Epic gathers information on local group names.[7]
S0381 FlawedAmmyy

FlawedAmmyy enumerates the privilege level of the victim during the initial infection.[8]
S0170 Helminth

Helminth has checked the local administrators group.[9]
S0201 JPIN

JPIN can obtain the permissions of the victim user.[10]
S0265 Kazuar

Kazuar gathers information about local groups and members.[11]
S0236 Kwampirs

Kwampirs collects a list of users belonging to the local users and administrators groups with the commands net localgroup administrators and net localgroup users.[12]
S0039 Net

Commands such as net group and net localgroup can be used in Net to gather information about and manipulate groups.[13]
G0049 OilRig

OilRig has used net localgroup administrators to find local administrators on compromised systems.[14]
G0116 Operation Wocao

Operation Wocao has used the command net localgroup administrators to list all administrators part of a local group.[15]
S0165 OSInfo

OSInfo has enumerated the local administrators group.[16]
S0378 PoshC2

PoshC2 contains modules, such as Get-LocAdm for enumerating permission groups.[17]
S0184 POWRUNER

POWRUNER may collect local group information by running net localgroup administrators or a series of other commands on a victim.[18]
S0650 QakBot

QakBot can use net localgroup to enable discovery of local groups.[19]
S0060 Sys10

Sys10 collects the group name of the logged-in user and sends it to the C2.[20]
G0131 Tonto Team

Tonto Team has used the ShowLocalGroupDetails command to identify administrator, user, and guest accounts on a compromised host.[21]
G0010 Turla

Turla has used net localgroup and net localgroup Administrators to enumerate group information, including members of the local administrators group.[22]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

ID Data Source Data Component
DS0017 Command Command Execution
DS0009 Process Process Creation

System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.

Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.

References

  1. FireEye Threat Intelligence. (2015, December 1). China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets. Retrieved December 4, 2015.
  2. Red Team Labs. (2018, April 24). Hidden Administrative Accounts: BloodHound to the Rescue. Retrieved October 28, 2020.
  3. ClearSky Cyber Security. (2021, January). “Lebanese Cedar” APT Global Lebanese Espionage Campaign Leveraging Web Servers. Retrieved February 10, 2021.
  4. Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved January 19, 2021.
  5. Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021.
  6. Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.
  7. Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.
  8. Proofpoint Staff. (2018, March 7). Leaked Ammyy Admin Source Code Turned into Malware. Retrieved May 28, 2019.
  9. Unit 42. (2017, December 15). Unit 42 Playbook Viewer. Retrieved December 20, 2017.
  10. Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
  11. Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.
  1. Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.
  2. Savill, J. (1999, March 4). Net.exe reference. Retrieved September 22, 2015.
  3. Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.
  4. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.
  5. Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.
  6. Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.
  7. Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017.
  8. Kuzmenko, A. et al. (2021, September 2). QakBot technical analysis. Retrieved September 27, 2021.
  9. Baumgartner, K., Golovkin, M.. (2015, May). The MsnMM Campaigns: The Earliest Naikon APT Campaigns. Retrieved April 10, 2019.
  10. Daniel Lughi, Jaromir Horejsi. (2020, October 2). Tonto Team - Exploring the TTPs of an advanced threat actor operating a large infrastructure. Retrieved October 17, 2021.
  11. Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.