Empire Net Local Users

Metadata

Contributors

Roberto Rodriguez @Cyb3rWard0g

Creation Date

2019/03/19

Modification Date

2020/09/20

Tactics

TA0007

Techniques

T1087.001

Tags

Local Users Enumeration

Dataset Description

This dataset represents adversaries enumerating all local users on an endpoint

Simulation Metadata

Tools

type

Name

Module

C2

Empire

[shell](net user)

Adversary View

(Empire: 1EHYPBVC) > agents

[*] Active agents:

Name     La Internal IP     Machine Name      Username                Process            PID    Delay    Last Seen            Listener
----     -- -----------     ------------      --------                -------            ---    -----    ---------            ----------------
4SUZ8X62 ps 172.18.39.5     WORKSTATION5      *THESHIRE\pgustavo      powershell         4092   5/0.0    2020-09-21 21:59:29  http            
1EHYPBVC ps 172.18.39.5     WORKSTATION5      *THESHIRE\pgustavo      powershell         7456   5/0.0    2020-09-21 23:25:39  http            

(Empire: agents) > interact 1EHYPBVC
(Empire: 1EHYPBVC) > shell net user
[*] Tasked 1EHYPBVC to run TASK_SHELL
[*] Agent 1EHYPBVC tasked with task ID 3
(Empire: 1EHYPBVC) > 
User accounts for \\WORKSTATION5

-------------------------------------------------------------------------------
DefaultAccount           Guest                    wardog                   
WDAGUtilityAccount       
The command completed successfully.

..Command execution completed.

(Empire: 1EHYPBVC) > 

Explore Datasets

Download & Decompress Dataset

import requests
from zipfile import ZipFile
from io import BytesIO

url = https://raw.githubusercontent.com/OTRF/Security-Datasets/master/datasets/atomic/windows/discovery/host/empire_shell_net_local_users.zip
zipFileRequest = requests.get(url)
zipFile = ZipFile(BytesIO(zipFileRequest.content))
datasetJSONPath = zipFile.extract(zipFile.namelist()[0])

Read JSON File

from pandas.io import json

df = json.read_json(path_or_buf=datasetJSONPath, lines=True)

Access Security Events

df.groupby(['Channel']).size().sort_values(ascending=False)