Skip to content

Add T1087 attack technique (account discovery)#793

Merged
shreyamalviya merged 4 commits intoguardicore:developfrom
shreyamalviya:T1087
Aug 27, 2020
Merged

Add T1087 attack technique (account discovery)#793
shreyamalviya merged 4 commits intoguardicore:developfrom
shreyamalviya:T1087

Conversation

@shreyamalviya
Copy link
Contributor

@shreyamalviya shreyamalviya commented Aug 18, 2020

Fixes #705

Some things to address:

  • Should we include more information such as the groups that a user belongs to, for Linux? Right now it just displays the user account names.
  • In Windows, the command to list out users is net user which outputs a bunch of other stuff, which is a little hard to manipulate. And we can't use the content from dir C:\Users\ /b since a user's folder is only created when the user logs in. Should we show the whole output content of net user in the report?
    image
@codecov
Copy link

codecov bot commented Aug 18, 2020

Codecov Report

Merging #793 into develop will increase coverage by 0.00%.
The diff coverage is 100.00%.

Impacted file tree graph

@@ Coverage Diff @@ ## develop #793 +/- ## ======================================== Coverage 60.33% 60.34% ======================================== Files 161 161 Lines 4901 4902 +1 ======================================== + Hits 2957 2958 +1  Misses 1944 1944 
Impacted Files Coverage Δ
...s/config_schema/definitions/post_breach_actions.py 100.00% <ø> (ø)
.../monkey_island/cc/services/config_schema/monkey.py 100.00% <ø> (ø)
monkey/common/data/post_breach_consts.py 100.00% <100.00%> (ø)

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 2ebbd24...f7065a9. Read the comment docs.

@ShayNehmad
Copy link
Contributor

Re including groups: not strictly necessary (but useful if it's cheap).
Re net user: powershell "Get-LocalUser" will work (and look) better. You could pipe the results into format-list or format-table or even powershell "Get-LocalUser | ConvertTo-Json".

@shreyamalviya shreyamalviya merged commit f8e1e76 into guardicore:develop Aug 27, 2020
@shreyamalviya shreyamalviya deleted the T1087 branch September 2, 2020 18:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

2 participants