Local account and group enumeration from a command line

Siemphony@siemphonylowT1087.001unverified

AN0846's `CommandLinePattern` knob names `net user`, `net localgroup` and `Get-LocalUser`; this rule is those three plus the wmic spelling added here, gated so that what matches is local rather than domain enumeration. The net leg wants net.exe or net1.exe — either can be the logged image, because net.exe re-executes itself as net1.exe — with a `user` or `localgroup` subcommand and without a `/domain` switch, and that absent switch is the whole discriminator against the sibling T1087.002, whose published rule requires it. `net accounts` is deliberately not in the verb list: it returns the password policy, which is T1201 rather than an account listing. The cmdlet leg matches `Get-LocalUser` and `Get-LocalGroup`, the second written without a suffix so it also covers `Get-LocalGroupMember` by substring; the WMI class name `Win32_UserAccount` is left out because the T1087.002 rule already carries it, while `wmic useraccount` is kept because that spelling appears in no other rule in this corpus. Three limits are structural. The domain exclusion is a substring test for ` /do` and ` -do`, which catches the switch as typed and as abbreviated but not a wrapper that passes it through a variable, so a domain query written that way falls into this rule as a false match on the sibling technique. A cmdlet called from inside a .ps1, a module or a here-string never reaches `CommandLine` at all. And MITRE's `UserContext` and `TimeWindow` knobs — fire only for unexpected or low-privileged accounts, or only on a burst of enumeration in short succession — are a per-identity baseline and a timeframe, neither of which Sigma models, so nothing here encodes them and the rule is left matching the single-event precursor, which is why the level sits at the bottom of the scale. The analytic's other two arms are not attempted: AN0847's Linux leg keys on reads of /etc/passwd, which getent, sudo, login and every id call perform constantly, and the brief supplies no field schema for macos/unifiedlog anywhere, so AN0848's fields would have to be invented. Expect overlap with the published T1033 rule, which selects the same net.exe ` user` shape as an owner discovery precursor. This rule is written in the Sysmon EventID 1 vocabulary (`Image`, `CommandLine`) that AN0846 names; an estate feeding Security 4688 instead needs `NewProcessName` mapped onto `Image` first, and 4688 needs both *Audit Process Creation* and the separate *Include command line in process creation events* policy before `CommandLine` exists at all — neither is on in a default install or in the Microsoft and CIS baselines. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0303, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((((FolderPath endswith "\\net.exe" or FolderPath endswith "\\net1.exe") and (ProcessCommandLine contains " user" or ProcessCommandLine contains " localgroup")) and not ((ProcessCommandLine contains " /do" or ProcessCommandLine contains " -do"))) or (ProcessCommandLine contains "Get-LocalUser" or ProcessCommandLine contains "Get-LocalGroup")) or (FolderPath endswith "\\wmic.exe" and ProcessCommandLine contains "useraccount"))

Splunk · SPL

Run this as a search.

index=* (((((Image="*\\net.exe" OR Image="*\\net1.exe") AND (CommandLine="* user*" OR CommandLine="* localgroup*")) AND NOT ((CommandLine="* /do*" OR CommandLine="* -do*"))) OR (CommandLine="*Get-LocalUser*" OR CommandLine="*Get-LocalGroup*")) OR (Image="*\\wmic.exe" AND CommandLine="*useraccount*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((((TO_LOWER(process.executable) LIKE "*\\\\net.exe" OR TO_LOWER(process.executable) LIKE "*\\\\net1.exe") AND (TO_LOWER(process.command_line) LIKE "* user*" OR TO_LOWER(process.command_line) LIKE "* localgroup*")) AND NOT ((TO_LOWER(process.command_line) LIKE "* /do*" OR TO_LOWER(process.command_line) LIKE "* -do*"))) OR (TO_LOWER(process.command_line) LIKE "*get-localuser*" OR TO_LOWER(process.command_line) LIKE "*get-localgroup*")) OR (TO_LOWER(process.executable) LIKE "*\\\\wmic.exe" AND TO_LOWER(process.command_line) LIKE "*useraccount*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 3 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\net\.exe$|\\net1\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)( user| localgroup)</field>    <field name="CommandLine" negate="yes" type="pcre2">(?i)( /do| -do)</field>    <description>Local account and group enumeration from a command line (1/3)</description>    <mitre>      <id>T1087.001</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(Get-LocalUser|Get-LocalGroup)</field>    <description>Local account and group enumeration from a command line (2/3)</description>    <mitre>      <id>T1087.001</id>    </mitre>  </rule>   <rule id="100002" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\wmic\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)useraccount</field>    <description>Local account and group enumeration from a command line (3/3)</description>    <mitre>      <id>T1087.001</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: discovery_recon
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 9f9c9b39-8b3d-4ea2-9e44-c798c9c707bf

ATT&CKT1087.001

T1087.001Local Account

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondiscovery recon

discovery reconAI draft — unreviewed

01 · What this rule detects

Someone listing the local accounts and local groups on a Windows host from a command line — the reconnaissance step that tells an adversary which local principals exist before they pick one to abuse. AN0846's CommandLinePattern knob names net user, net localgroup and Get-LocalUser; the rule is those three plus a wmic useraccount spelling added by the pipeline, gated so that what matches is local rather than domain enumeration.

02 · Telemetry you need

Sysmon EventID 1, the only log source AN0846 offers, through the process_creation / windows logsource copied verbatim from the brief. The rule touches Image and CommandLine and nothing else. An estate feeding Security 4688 instead must map NewProcessName onto Image, and 4688 has no CommandLine until both Audit Process Creation and the separate Include command line in process creation events policy are turned on — neither is default, nor in the Microsoft and CIS baselines. The analytic's other arms are not attempted: AN0847's Linux leg keys on /etc/passwd reads, which getent, sudo, login and every id call perform constantly, and the brief supplies no field schema anywhere for macos/unifiedlog, so AN0848's fields would have to be invented.

03 · How the logic works

Three independent legs, OR-ed. The net leg pairs selection_net_binary (Image|endswith on \net.exe or \net1.exe — net.exe re-executes itself as net1.exe, so both appear, and every net user therefore produces two matching events and two alerts) with selection_net_verb (CommandLine|contains user or localgroup), minus filter_domain_scope, a substring test for /do and -do. That absent switch is what separates this from the sibling T1087.002, whose rule requires it. net accounts is deliberately absent: it returns the password policy, which is T1201. selection_local_cmdlet is an unanchored CommandLine|contains on Get-LocalUser and Get-LocalGroup, the second without a suffix so it also picks up Get-LocalGroupMember. selection_wmic_useraccount requires \wmic.exe as the image plus useraccount in the command line.

04 · Common false positives

Constantly, which is why level is low. Configuration Manager baselines, Intune remediation, RMM checks and CIS benchmark tests read the local Administrators group on a schedule across every host; credentialed Nessus, Qualys and Lansweeper scans call wmic useraccount get name,sid; installers check group membership before creating service accounts; service desk staff run net user as ordinary first-line work. Review also found real scope drift: the two non-cmdlet legs do not distinguish reads from writes, so net user bob P@ssw0rd /add (T1136.001), net user bob /delete and wmic useraccount ... set disabled=true (both T1531) all match here.

05 · Detection maturity

tier_1: Lowest tier until it has been run against real data. It is authored from a scaffold that carries no query logic and has never touched a log line, so its true-positive and false-positive rates are unknown. Clean rendering in Sentinel KQL, Splunk SPL, Elastic ES|QL and Wazuh XML proves it parses, not that it fires. Baseline the volume before anyone routes it anywhere but a dashboard.

Tuning & false positivesexperimental · 5 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE's UserContext and TimeWindow knobs — fire only for unexpected or low-privileged accounts, and only on bursts of enumeration in short succession — are a per-identity baseline and a timeframe. Sigma models neither, so nothing in this rule encodes them and it is left matching a single-event precursor. Do that correlation in your platform, not here. Cheap wins in the YAML: extend filter_domain_scope with /add, /delete and /active: to shed the write verbs, and require get or list on the wmic leg. Keep the negation on one field so Wazuh still renders it. Know the ceiling: an unanchored CommandLine substring sees nothing invoked from a .ps1, a module, a here-string, or powershell -EncodedCommand, and AN0846 offers no 4104 source to close it.

Declared by the author

Endpoint management and compliance tooling. Configuration Manager baselines, Intune remediation scripts, RMM checks and CIS benchmark tests read the local Administrators group with net localgroup administrators or Get-LocalGroup on a fixed schedule on every host in the estate. This is the highest-volume match here by a wide margin, it runs under a service account rather than a person, and it is the reason this rule is scored low rather than medium.
Service desk and administrative troubleshooting. Confirming that a local account exists, is enabled, or is a member of the local Administrators group with net user or net localgroup is ordinary first-line work and produces an event indistinguishable from the adversary's.
Inventory and credentialed vulnerability scanning. Asset-management agents and authenticated Nessus, Qualys or Lansweeper policies call wmic useraccount get name,sid to inventory local principals, so every scan window produces one match per scanned host.
Installers and prerequisite checks. Server products, database engines and driver packages read local group membership before creating or configuring a service account, so an install, repair or upgrade emits a match with no operator intent behind it.
Logon and startup scripts that branch on local administrator membership, which fire once per user per session across the whole estate with nobody at the keyboard.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification2 runs

Not verified

Security Datasets — Local accounts and groups enumerated with Seatbelt
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1087.001, evaluated against their process_creation events.

Share this rule

/u/siemphony/9f9c9b39-8b3d-4ea2-9e44-c798c9c707bf

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Local account and group enumeration from a command line

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it