CyberStack

MITRE ATT&CK / Techniques / T1087.001

Account Discovery: Local Account

ID
T1087.001
Tactics
TA0007 Discovery
Sub-technique of
T1087 Account Discovery
Platforms
ESXi, Linux, macOS, Windows
Data sources
Process Creation, File Access, User Account Metadata
Source
attack.mitre.org
MITRE last modified
12 May 2026

Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.

Commands such as net user and net localgroup of the Net utility and id and groups on macOS and Linux can list local users and groups.[2][3][4] On Linux, local users can also be enumerated through the use of the /etc/passwd file. On macOS, the dscl . list /Users command can be used to enumerate local accounts. On ESXi servers, the esxcli system account list command can list local user accounts.[5]

Detection

Mitigations (1)

M1028 Operating System Configuration

Prevent administrator accounts from being enumerated when an application is elevating through UAC since it can lead to the disclosure of account names. The Registry key is located at HKLM\ SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\EnumerateAdministrators. It can be disabled through GPO: Computer Configuration > [Policies] > Administrative Templates > Windows Components > Credential User Interface: Enumerate administrator accounts on elevation.[1]

Groups (19)

Software (45)

References

  1. UCF STIG Elevation Account Enumeration
  2. Mandiant APT1
  3. id man page
  4. groups man page
  5. Crowdstrike Hypervisor Jackpotting Pt 2 2021