Hello and welcome to another
application of the minor attack
framework discussion today
we're going to be getting into
account discovery.
So today's objectives are as
follows. We're going to describe
account discovery and some
applicable commands that we can use
based on the operating system in
question to discover account
information.
What are some mitigation techniques
that we can use in this process
and help to maybe prevent
or at least further deter a
threat actor from getting
information?
And what are some detection
techniques that we can use here as
well?
Now, account discovery is
a very simple definition,
not getting too heavy into
language or anything of that nature.
It's just when a threat actually
works to get a listing of local
or domain accounts, local system
or domain accounts.
And so that's essentially what they
are hoping to do so that they can
use those maybe to their benefit,
the use of password cracking or
something of that nature.
And so some commands that we can use
are going to be dependent on the
underlying operating system.
As you can see here, I just
dotted out the name, but we use
that user.
And as you can see, it provided a
return of some different usernames
that was blacked out, default
account, et cetera.
GUEST So
there may be something there that a
threat actor could use.
They may see if this account
is active.
They may see if the guest account is
active just so that they could maybe
get on a system and do
some research and further work.
Now, some of the Windows commands
are things like net user
that will give you some information
about user accounts, that group,
that local group.
And then on the Macs, you've got
groups ID, DCL
that list groups, some
other utilities here that
you can use Linux, you can get
to the password directory groups,
you can use ID.
So there's a number of different
commands that a threat doctor could
use to attempt to get
user account information.
They could type this out to a text
file or pipe this out
to a file somewhere
on the system that you may not see
it so that they can have that
information for further evaluation
and use.
Now, what are some mitigation
techniques that we could use to
potentially keep a threat
actor from taking advantage of our
system and getting account
information?
Well, we can prevent
administrator accounts from being
enumerated when an application is
elevated through UAC.
And so we can use the GPO under
computer configuration policies,
administrative templates, Windows
components and then credential user
interface, enumerate administrator
accounts on elevation.
And we can make some adjustments
there so that
users let's just say if I'm a
standard user, I can't use the
command prompt.
And there are some unique
capabilities or some ways that I can
then elevate my privileges.
For some reason we
can prevent enumeration through
that elevation.
Now, some detection techniques that
we can take into consideration here.
We can look for behavioral
patterns that would indicate a
threat. Actors attempting to
discover information about the
network.
So do we have in map scans going on?
Do we have some
of these commands that are being run
that we just discussed?
Do we have a lot of, like ping
sweeps going on?
Anything that we can monitor and
then correlate could be beneficial
with respect to detecting that type
of activity.
We can monitor processes and command
line arguments essentially for
actions, again,
that may be used to gather sensitive
information.
And so, you know your environment
best. And so if there's anything
that kind of raises a question
and you're not sure whether or not
that activity is legit, you've never
seen these types of applications
used on the network before.
There's a lot of heavy scripting
that's going on.
And you know that you're not the one
writing some of these scripts and
doing some of these things.
It would be worth looking into
to ensure that you don't have
somebody that's doing something they
shouldn't be doing.
So let's do a quick check on
learning. True or false
account discovery is when a threat
actor attempts to discover what
usernames are on a system.
All right, well, if you need
additional time, please pause
the video.
So in this case, account discovery
is when a threat actor
does attempt to discover what user
names are on a system.
So in the case of this statement, it
is true.
All right. So let's go ahead and pop
over to our summary for this
discussion.
So we described account
discovery. Again, it's just a threat
actor attempting to figure out
who is using a system
who can access a system.
We also look at some commands
in between these two areas here
discussing what you can do on
Windows versus Mac versus Linux
to potentially get a listing
of accounts.
We looked at some mitigation
techniques, such as preventing
administrators from using elevated
prompts or from a user that elevates
into a prompt from
doing account discovery and things
of that nature, doing a numeration.
And then we describe some detection
techniques, primarily focusing on
network activity and system activity
that would be out of the norm.
So with that in mind, I want
to thank you for your time today,
and I look forward to seeing you
again soon.