Skip to content

Add T1087 attack technique (account discovery)#793

Merged
shreyamalviya merged 4 commits into
guardicore:developfrom
shreyamalviya:T1087
Aug 27, 2020
Merged

Add T1087 attack technique (account discovery)#793
shreyamalviya merged 4 commits into
guardicore:developfrom
shreyamalviya:T1087

Conversation

@shreyamalviya

@shreyamalviya shreyamalviya commented Aug 18, 2020

Copy link
Copy Markdown
Contributor

Fixes #705

Some things to address:

  • Should we include more information such as the groups that a user belongs to, for Linux? Right now it just displays the user account names.
  • In Windows, the command to list out users is net user which outputs a bunch of other stuff, which is a little hard to manipulate. And we can't use the content from dir C:\Users\ /b since a user's folder is only created when the user logs in. Should we show the whole output content of net user in the report?
    image

@codecov

codecov Bot commented Aug 18, 2020

Copy link
Copy Markdown

Codecov Report

Merging #793 into develop will increase coverage by 0.00%.
The diff coverage is 100.00%.

Impacted file tree graph

@@           Coverage Diff            @@
##           develop     #793   +/-   ##
========================================
  Coverage    60.33%   60.34%           
========================================
  Files          161      161           
  Lines         4901     4902    +1     
========================================
+ Hits          2957     2958    +1     
  Misses        1944     1944           
Impacted Files Coverage Δ
...s/config_schema/definitions/post_breach_actions.py 100.00% <ø> (ø)
.../monkey_island/cc/services/config_schema/monkey.py 100.00% <ø> (ø)
monkey/common/data/post_breach_consts.py 100.00% <100.00%> (ø)

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 2ebbd24...f7065a9. Read the comment docs.

@ShayNehmad

Copy link
Copy Markdown
Contributor

Re including groups: not strictly necessary (but useful if it's cheap).
Re net user: powershell "Get-LocalUser" will work (and look) better. You could pipe the results into format-list or format-table or even powershell "Get-LocalUser | ConvertTo-Json".

Comment thread monkey/monkey_island/cc/services/attack/technique_reports/T1087.py
@shreyamalviya shreyamalviya merged commit f8e1e76 into guardicore:develop Aug 27, 2020
@shreyamalviya shreyamalviya deleted the T1087 branch September 2, 2020 18:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add "Account Discovery" technique (T1087)

2 participants