admin@338 actors used the following commands following exploitation of a machine withLOWBALL malware to enumerate user accounts:net user >> %temp%\downloadnet user /domain >> %temp%\download^[5]

Agent Tesla can collect account information from the victim’s machine.^[6]

APT1 used the commandsnet localgroup,net user, andnet group to find accounts on the system.^[1]

APT3 has used a tool that can obtain info about local and global group users, power users, and administrators.^[7]

APT32 enumerated administrative users using the commandsnet localgroup administrators.^[8]

APT41 used built-innet commands to enumerate local administrator groups.^[9]

APT42 has used the PowerShell-based POWERPOST script to collect local account names from the victim machine.^[10]

Bankshot gathers domain and account names/information through process monitoring.^[11]

Bazar can identify administrator accounts on an infected host.^[12]

BitPaymer can enumerate the sessions for each user logged onto the infected host.^[13]

BloodHound can identify users with local administrator rights.^[14]

Chimera has usednet user for account discovery.^[15]

Comnie uses thenet user command.^[16]

The discovery modules used withDuqu can collect information on accounts and permissions.^[17]

DUSTTRAP can enumerate local user accounts.^[18]

Elise executesnet user after initial communication is made to the remote server.^[19]

Empire can acquire local and domain user account information.^[20]

Epic gathers a list of all user accounts, privilege classes, and time of last logon.^[21]

Fox Kitten has accessed ntuser.dat and UserClass.dat on compromised hosts.^[22]

GeminiDuke collects information on local user accounts from the victim.^[23]

HyperStack can enumerate all account names on a remote share.^[24]

InvisibleFerret has queried the victim device using Python scripts to obtain the User and Hostname.^[25][26]

InvisiMole has a command to list account information on the victim’s machine.^[27]

Kazuar gathers information on local groups and members on the victim’s machine.^[28]

Ke3chang performs account discovery using commands such asnet localgroup administrators andnet group "REDACTED" /domain on specific permissions groups.^[29]

Kwampirs collects a list of accounts with the commandnet users.^[30]

Lotus Blossom has used commands such asnet to profile local system users.^[31]

Medusa Group has leveragednet user for account discovery.^[32]

MgBot includes modules for identifying local administrator accounts on victim systems.^[33]

Milan has runC:\Windows\system32\cmd.exe /c cmd /c dir c:\users\ /s 2>&1 to discover local accounts.^[34]

Mis-Type may create a file containing the results of the commandcmd.exe /c net user {Username}.^[35]

Moses Staff has collected the administrator username from a compromised host.^[36]

MURKYTOP has the capability to retrieve information about users on remote hosts.^[37]

Commands undernet user can be used inNet to gather information about and manipulate user accounts.^[38]

OilRig has runnet user,net user /domain,net group "domain admins" /domain, andnet group "Exchange Trusted Subsystem" /domain to get account listings on a victim.^[39]

DuringOperation CuckooBees, the threat actors used thenet user command to gather account information.^[40]

OSInfo enumerates local and domain users^[7]

P.A.S. Webshell can display the /etc/passwd file on a compromised host.^[41]

Pikabot will retrieve the name of the user associated with the thread under which the malware is executing.^[42]

Pony has used theNetUserEnum function to enumerate local accounts.^[43]

Poseidon Group searches for administrator accounts on both the local victim machine and the network.^[44]

PoshC2 can enumerate local and domain user account information.^[45]

PowerSploit'sGet-ProcessTokenGroup Privesc-PowerUp module can enumerate all SIDs associated with its current token.^[46][47]

POWERSTATS can retrieve usernames from compromised hosts.^[48]

PUNCHBUGGY can gather user names.^[49]

Pupy uses PowerView and Pywerview to perform discovery commands such as net user, net group, net local group, etc.^[50]

Qilin can list all local users found on a targeted system.^[51]

Raccoon Stealer checks the privileges of running processes to determine if the running user is equivalent toNT Authority\System.^[52]

RATANKBA uses thenet user command.^[53]

RedCurl has collected information about local accounts.^[54][55]

RedLine Stealer has collected account information from the victim’s machine.^[56][57]

Remsec can obtain a list of users.^[58]

S-Type has run the commandnet user on a victim.^[35]

SHOTPUT has a command to retrieve information about connected users.^[59]

SMOKEDHAM has usednet.exe user andnet.exe users to enumerate local accounts on a compromised host.^[60]

SoreFang can collect usernames from the local system vianet.exe user.^[61]

Stuxnet enumerates user accounts of the local host.^[62]

Threat Group-3390 has usednet user to conduct internal discovery of systems.^[63]

TrickBot collects the users of the system.^[64][65]

Turla has usednet user to enumerate local accounts on the system.^[66][67]

USBferry can usenet user to gather information about local accounts.^[68]

Valak has the ability to enumerate local admin accounts.^[69]

Volt Typhoon has executednet user andquser to enumerate local account information.^[70]

Prevent administrator accounts from being enumerated when an application is elevating through UAC since it can lead to the disclosure of account names. The Registry key is located atHKLM\ SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\EnumerateAdministrators. It can be disabled through GPO: Computer Configuration > [Policies] > Administrative Templates > Windows Components > Credential User Interface: Enumerate administrator accounts on elevation.^[71]

Adversary enumeration of local user accounts using Net.exe, WMI, or PowerShell.

Enumeration of local users or groups via file access (/etc/passwd) or commands like id, groups.

Enumeration of macOS local users using dscl, id, dscacheutil, or /etc/passwd access.

Enumeration of local ESXi accounts using esxcli or vSphere API from unauthorized sessions.