The Get-MsolRoleMember PowerShell cmdlet can be used to obtain account names given a role or permissions group.(Citation: Microsoft msolrolemember)(Citation: GitHub Raindance)Īzure CLI (AZ CLI) also provides an interface to obtain user accounts with authenticated access to a domain. With authenticated access there are several tools that can be used to find accounts. In mac, this same file is only used in single-user mode in addition to the /etc/master.passwd file.Īlso, groups can be enumerated through the groups and id commands. On Linux, local users can be enumerated through the use of the /etc/passwd file which is world readable. list /Groups and dscacheutil -q group can also be used to enumerate groups and users.

On Mac, groups can be enumerated through the groups and id commands. If adversaries attempt to identify the primary user, currently logged in user, or set of users that commonly uses a system, () may apply. Technique Name: Account Discovery Technique Description Adversaries may attempt to get a listing of local system or domain accounts.Įxample commands that can acquire this information are net user, net group, and net localgroup using the () utility or through use of (). (Citation: Palo Alto OilRig April 2017) (Citation: ClearSky OilRig Jan 2017) (Citation: Palo Alto OilRig May 2016) (Citation: Palo Alto OilRig Oct 2016) (Citation: Unit 42 Playbook Dec 2017) (Citation: FireEye APT)(Citation: Unit 42 QUADAGENT July 2018) This group was previously tracked under two distinct groups, APT34 and OilRig, but was combined due to additional reporting giving higher confidence about the overlap of the activity. FireEye assesses that the group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets.

The group has targeted a variety of industries, including financial, government, energy, chemical, and telecommunications, and has largely focused its operations within the Middle East. This snippet of data is scoped to the following actor groups:Īctor: OilRig Actor Description () is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014.

The following content is generated using a preview release of Swimlane's pyattck.

Vmware horizon servers under by iranian