Empire Net Domain Users#

Metadata#

Contributors

Roberto Rodriguez @Cyb3rWard0g

Creation Date

2019/03/19

Modification Date

2020/09/20

Tactics

TA0007

Techniques

T1087.002

Tags

Domain Users Enumeration,RPC SAMR EnumDomainUsers

Dataset Description#

This dataset represents adversaries enumerating all users that belong to a domain via RPC SAMR EnumDomainUsers.

Simulation Metadata#

Tools#

type

Name

Module

C2

Empire

shell

Adversary View#

(Empire: 1EHYPBVC) > agents

[*] Active agents:

Name     La Internal IP     Machine Name      Username                Process            PID    Delay    Last Seen            Listener
----     -- -----------     ------------      --------                -------            ---    -----    ---------            ----------------
4SUZ8X62 ps 172.18.39.5     WORKSTATION5      *THESHIRE\pgustavo      powershell         4092   5/0.0    2020-09-21 21:59:29  http            
1EHYPBVC ps 172.18.39.5     WORKSTATION5      *THESHIRE\pgustavo      powershell         7456   5/0.0    2020-09-21 23:25:39  http            

(Empire: agents) > interact 1EHYPBVC

(Empire: 1EHYPBVC) > shell net user /domain
[*] Tasked 1EHYPBVC to run TASK_SHELL
[*] Agent 1EHYPBVC tasked with task ID 5
(Empire: 1EHYPBVC) > 
The request will be processed at a domain controller for domain theshire.local.

User accounts for \\MORDORDC.theshire.local

-------------------------------------------------------------------------------
dschrute                 Guest                    krbtgt                   
lrodriguez               mscott                   nmartha                  
pbeesly                  pgustavo                 sbeavers                 
sysmonsvc                wardog                   
The command completed successfully.

..Command execution completed.

(Empire: 1EHYPBVC) >

Explore Datasets#

Download & Decompress Dataset#

import requests
from zipfile import ZipFile
from io import BytesIO

url = https://raw.githubusercontent.com/OTRF/Security-Datasets/master/datasets/atomic/windows/discovery/host/empire_shell_samr_EnumDomainUsers.zip
zipFileRequest = requests.get(url)
zipFile = ZipFile(BytesIO(zipFileRequest.content))
datasetJSONPath = zipFile.extract(zipFile.namelist()[0])

Read JSON File#

from pandas.io import json

df = json.read_json(path_or_buf=datasetJSONPath, lines=True)

Access Security Events#

df.groupby(['Channel']).size().sort_values(ascending=False)