216.73.217.22

T1087.001: T1087.001

View on MITRE ATT&CK The MITRE Corporation · Published 16/12/2025 19:37 · Modified 21/04/2026 11:28

Essential information

MITRE technique ID
T1087.001
Confidence
100/100
Revoked
No
Published
16/12/2025 19:37
Modified
21/04/2026 11:28
Author / Source
The MITRE Corporation

Aliases

Local Account

Platforms

windows macos linux ESXi

Description

Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior. Commands such as `net user` and `net localgroup` of the [Net](https://attack.mitre.org/software/S0039) utility and `id` and `groups` on macOS and Linux can list local users and groups.(Citation: Mandiant APT1)(Citation: id man page)(Citation: groups man page) On Linux, local users can also be enumerated through the use of the `/etc/passwd` file. On macOS, the `dscl . list /Users` command can be used to enumerate local accounts. On ESXi servers, the `esxcli system account list` command can list local user accounts.(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)

Kill chain phases

Kill chainPhase
mitre-attack discovery

Marking (TLP)

TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.

External references

Related entities

Intrusion sets, malware, reports, vulnerabilities, indicators and other entities linked to this technique.