T1087.001

Official Description

Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.

Commands such as <code>net user</code> and <code>net localgroup</code> of the [Net](https://attack.mitre.org/software/S0039) utility and <code>id</code> and <code>groups</code> on macOS and Linux can list local users and groups.(Citation: Mandiant APT1)(Citation: id man page)(Citation: groups man page) On Linux, local users can also be enumerated through the use of the <code>/etc/passwd</code> file. On macOS, the <code>dscl . list /Users</code> command can be used to enumerate local accounts. On ESXi servers, the `esxcli system account list` command can list local user accounts.(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)

Tactics: Discovery
Platforms: ESXi, Linux, macOS, Windows
Parent Technique: T1087 · Account Discovery
MITRE Version: 1.5
Last Modified: May 12, 2026

View on MITRE ATT&CK ↗

Reported Context (4)

The built-in Get-LocalUser handler enumerates local user accounts using NetUserEnum. Zscaler Details SloppyRAT, a New Malware Linked to Ransomware Attacks
The threat actor queried local administrator and other local accounts on servers. Bing SEO Poisoning Led to BumbleBee, AdaptixC2 and Akira Ransomware Intrusions
The attacker reviewed local accounts and permissions through the Local Users and Groups snap-in. Lynx Ransomware Attack Began with Compromised RDP Credentials
Betruger-spawned commands included net user for user enumeration. DFIR Report Links Intrusion to Tools Used by Three Ransomware Groups

Malware (11)

People (14)

Threat Actors (3)

MITRE ATT&CK (72)

Vendors (9)

Products (18)

Tools (19)

Countries (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.