T1087.001 — Local Account

Tactic: Discovery · Platforms: ESXi, Linux, macOS, Windows

Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior. Commands such as net user and net localgroup of the Net utility and id and groups on macOS and Linux can list…

Sub-technique of Account Discovery (T1087).

Sigma detection rules (4)

T1087.001 Account Discovery: Local Account

title: "T1087.001 Account Discovery: Local Account"
id: 8effd4e7-fd00-4d68-9fe7-88d2a6e752d1
description: 'Local Account Enumeration Across Host Platforms. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: CommandLinePattern, UserContext, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1087/001
author: Shahrukh Khan
date: 2026-01-24
license: MIT
tags:
  - attack.discovery
  - attack.t1087.001

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
    CommandLine|contains: 'user'

  condition: selection

falsepositives:
  - Routine local-account enumeration by IT/helpdesk tooling and login scripts.

level: informational

T1087.001 Account Discovery: Local Account

title: "T1087.001 Account Discovery: Local Account"
id: d502f4fa-81fb-4ccb-818a-6df060b5bf03
description: 'Local Account Enumeration Across Host Platforms via /etc/passwd reads (cat/awk/cut), getent passwd, and the id/groups commands the technique explicitly cites as primary Linux enumeration tools. Fixed dead getent logic (getent passwd never has an /etc/passwd argument in argv) by giving getent its own selector keyed on the passwd database name instead. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AccessedFile, ExecutionScope.'
references:
  - https://attack.mitre.org/techniques/T1087/001
author: Shahrukh Khan
date: 2026-05-02
license: MIT
tags:
  - attack.discovery
  - attack.t1087.001

logsource:
  category: process_creation
  product: linux

detection:
  selection_passwd_file:
    type: EXECVE
    a0|endswith:
      - '/cat'
      - '/awk'
      - '/cut'
    a1|contains: '/etc/passwd'
  selection_getent:
    type: EXECVE
    a0|endswith: '/getent'
    a1: 'passwd'
  selection_id:
    type: EXECVE
    a0|endswith: '/id'
  selection_groups:
    type: EXECVE
    a0|endswith: '/groups'

  condition: 1 of selection_*

falsepositives:
  - Reading /etc/passwd via cat/awk/cut/getent, and running id/groups, are extremely routine admin, scripting, and even interactive shell-prompt actions (id/groups in particular are very high-volume); scope ExecutionScope to non-interactive/automated contexts or unusual parent processes to reduce noise.

level: informational

T1087.001 Account Discovery: Local Account

title: "T1087.001 Account Discovery: Local Account"
id: 6715060b-13c7-43dc-a1b9-b036a962c718
description: 'Local Account Enumeration Across Host Platforms. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CommandLine, InteractiveSession.'
references:
  - https://attack.mitre.org/techniques/T1087/001
author: Shahrukh Khan
date: 2026-01-15
license: MIT
tags:
  - attack.discovery
  - attack.t1087.001

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/dscl'
    CommandLine|contains|all:
      - '.'
      - 'list'
      - '/Users'

  condition: selection

falsepositives:
  - Local administrative scripts enumerating local user accounts for routine auditing.

level: low

T1087.001 Account Discovery: Local Account

title: "T1087.001 Account Discovery: Local Account"
id: d912a321-4d90-4764-8165-088b4735f4db
description: 'Local Account Enumeration Across Host Platforms. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CommandPattern, SessionType.'
references:
  - https://attack.mitre.org/techniques/T1087/001
author: Shahrukh Khan
date: 2026-03-25
license: MIT
tags:
  - attack.discovery
  - attack.t1087.001

logsource:
  product: esxi
  service: shell

detection:
  selection:
    CommandLine|contains:
      - 'esxcli system account list'
      - 'cat /etc/passwd'

  condition: selection

falsepositives:
  - Routine account audits by administrators also read /etc/passwd or list local accounts.

level: low

Related sub-techniques

Explore