Added TTP TA0007 Discovery: T1087.001 Local Account #50
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Proposed Changes
Added MITRE ATT&CK TTP for Account Discovery.
Tactic: TA0007 Discovery
Techniques: T1087 Account Discovery
Subtechniques: T1087.001 Local Account
This TTP leverages the Directory Service Command Line (DSCL) utility to pull a list of local user accounts on MacOS.
Related Issue(s)
No issues to report from this change. Simply adding another TTP to this repository.
Testing
Identified the command and syntax needed to pull local user accounts from MacOS.
Ran the command locally to confirm that user accounts are being printed as expected.
Added the "list_local_users" folder within the "macOS" parent folder.
Added the "list_local_users.yaml" file under the "list_local_users" folder.
Added the command to print user account names: "dscl . list /Users | grep -v “^_”"
Ran the YAML file locally and confirmed that user accounts are being printed and no issues arise.
Documentation
No documentation updates have been made.
Screenshots/GIFs (optional)
Not applicable.
Checklist
mage runprecommit
locally and fixed any issues that arose.