Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add T1087 attack technique (account discovery) #793

Merged
merged 4 commits into from
Aug 27, 2020

Conversation

shreyamalviya
Copy link
Contributor

@shreyamalviya shreyamalviya commented Aug 18, 2020

Fixes #705

Some things to address:

  • Should we include more information such as the groups that a user belongs to, for Linux? Right now it just displays the user account names.
  • In Windows, the command to list out users is net user which outputs a bunch of other stuff, which is a little hard to manipulate. And we can't use the content from dir C:\Users\ /b since a user's folder is only created when the user logs in. Should we show the whole output content of net user in the report?
    image

@codecov
Copy link

codecov bot commented Aug 18, 2020

Codecov Report

Merging #793 into develop will increase coverage by 0.00%.
The diff coverage is 100.00%.

Impacted file tree graph

@@           Coverage Diff            @@
##           develop     #793   +/-   ##
========================================
  Coverage    60.33%   60.34%           
========================================
  Files          161      161           
  Lines         4901     4902    +1     
========================================
+ Hits          2957     2958    +1     
  Misses        1944     1944           
Impacted Files Coverage Δ
...s/config_schema/definitions/post_breach_actions.py 100.00% <ø> (ø)
.../monkey_island/cc/services/config_schema/monkey.py 100.00% <ø> (ø)
monkey/common/data/post_breach_consts.py 100.00% <100.00%> (ø)

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 2ebbd24...f7065a9. Read the comment docs.

@ShayNehmad
Copy link
Contributor

Re including groups: not strictly necessary (but useful if it's cheap).
Re net user: powershell "Get-LocalUser" will work (and look) better. You could pipe the results into format-list or format-table or even powershell "Get-LocalUser | ConvertTo-Json".

@shreyamalviya shreyamalviya merged commit f8e1e76 into guardicore:develop Aug 27, 2020
@shreyamalviya shreyamalviya deleted the T1087 branch September 2, 2020 18:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add "Account Discovery" technique (T1087)
2 participants