Command Line
net localgroup Administrators
Description
Used to gather information about local administrators on the current machine.
Risk
Low
Risk Reason
NET is commonly used to view details about a local or remote user, especially when troubleshooting permission or access issues.
Fidelity
Low
Fidelity Reason
Alerting on general NET commands will typically yield a high-false positive rate due to normal IT operations.
Operating Systems
Killchain Phases
References
MITRE ATT&CK TECHNIQUES
URL: https://attack.mitre.org/techniques/T1087/001
Description: Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.
Commands such as net user and net localgroup of the [Net](https://attack.mitre.org/software/S0039) utility and id and groupson macOS and Linux can list local users and groups. On Linux, local users can also be enumerated through the use of the /etc/passwd file. On macOS the dscl . list /Users command can be used to enumerate local accounts.
Tactics: