ATT&CK coverage › Technique

Account Discovery: Local Account T1087.001

Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.

Events covered

6 catalog events are tagged with this technique by at least one rule.

ProviderEvent IDTitle
Sysmon1Process creation
Sysmon3Network connection
Sysmon11FileCreate
Security-Auditing4688A new process has been created.
PowerShell4103Payload Context: ContextInfo User Data: UserData.
PowerShell4104Creating Scriptblock text (MessageNumber of MessageTotal).

Authoring guide

Patterns shared across the 16 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (12 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
CommandLine6match 6Usuarios de escritorio remoto, Exchange Trusted Subsystem, administrator, --Loop --Loopduration , -ZipFileName
Image5ends_with 4, match 1\net1.exe, \svchost.exe, \SharpHound.exe, \Bloodhound.exe, \quser.exe
ScriptBlockText4eq 3, match 1Invoke-SauronEye, Get-FoxDump, Invoke-KrbRelay, "*Get-LocalUser*", "*Win32_UserAccount*"
OriginalFileName3eq 3whoami.exe, qwinsta.exe, quser.exe, net.exe, net1.exe
EventID3eq 34104
file_name2in 2"*-azapplicationadmins.json", "*-azcloudappadmins.json", "*-azurecollection.zip", "*_groups.json", "*_users.json"
TargetFilename1ends_with 1, starts_with 1_computers.json, _ous.json, C:\Program Files\WindowsApps\Microsoft.
Product1match 1SharpHound
Description1match 1SharpHound
Company1match 1evil corp, SpecterOps
Payload1match 1Get-MachineAccountCreator, Invoke-SauronEye, Get-FoxDump
DestinationPort1eq 19389

Top indicator values (673 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.

FieldKindValueRules (here)Corpus reach
EventIDeq41043108
Imageends_with\net.exe227
Imageends_with\net1.exe225
CommandLinematchExchange Trusted Subsystem22
CommandLinematchenterprise admins22
CommandLinematchUsuarios de escritorio remoto23
CommandLinematch administrator22
CommandLinematchRemote Desktop Users23
CommandLinematchdomain admins22
CommandLinematchUtilisateurs du Bureau à distance23
CommandLinematch administrateur23
TargetFilenamestarts_withC:\Program Files\WindowsApps\Microsoft.1
Imageends_with\svchost.exe120
TargetFilenameends_with\pocket_containers.json1
TargetFilenameends_with_gpos.json1
TargetFilenameends_with_containers.json1
TargetFilenameends_with_ous.json1
TargetFilenameends_withBloodHound.zip1
TargetFilenameends_with_users.json1
TargetFilenameends_with_groups.json1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 9 rules

Splunk 6 rules

Kusto Query Language 1 rule