ATT&CK technique

T1087.001

Local Account

Discovery 34 detections found

Detection rules

Source	Rule	Status	Updated
splunk	Detect SharpHound File Modifications	production	2026-10-02
splunk	GetLocalUser with PowerShell	production	2026-10-02
splunk	Detect SharpHound Usage	production	2026-10-02
splunk	Detect SharpHound Command-Line Arguments	production	2026-10-02
elastic	ESXi System and Account Enumeration	production	2026-09-30
elastic	PowerShell Suspicious Discovery Related Windows API Functions	production	2026-09-18
elastic	Unusual User Privilege Enumeration via id	production	2026-09-18
elastic	Mounting Hidden or WebDav Remote Shares	production	2026-09-18
elastic	Enumeration of Administrator Accounts	production	2026-09-18
elastic	Enumeration of Users or Groups via Built-in Commands	production	2026-09-18
elastic	Potential Meterpreter Reverse Shell	production	2026-09-18
splunk	Windows User Discovery Via Net	production	2026-08-05
sigma	Local System Accounts Discovery - MacOs	test	2026-07-07
sigma	Suspicious Use of PsLogList	test	2026-06-29
splunk	GetWmiObject User Account with PowerShell Script Block	production	2026-05-13
splunk	Detect AzureHound Command-Line Arguments	production	2026-05-13
splunk	Detect AzureHound File Modifications	production	2026-05-13
splunk	GetLocalUser with PowerShell Script Block	production	2026-05-13
splunk	GetWmiObject User Account with PowerShell	production	2026-05-13
splunk	Local Account Discovery With Wmic	production	2026-05-13
splunk	Network Traffic to Active Directory Web Services Protocol	production	2026-05-13
splunk	Windows Account Discovery for None Disable User Account	production	2026-05-13
splunk	Windows SOAPHound Binary Execution	production	2026-05-13
sigma	BloodHound Collection Files	test	2026-02-19
sigma	Malicious PowerShell Commandlets - ScriptBlock	test	2025-12-10
sigma	Malicious PowerShell Commandlets - ProcessCreation	test	2025-12-10
sigma	Malicious PowerShell Commandlets - PoshModule	test	2025-12-10
sigma	Local Accounts Discovery	test	2025-10-20
sigma	Local System Accounts Discovery - Linux	test	2024-12-10
sigma	Suspicious Group And Account Reconnaissance Activity Using Net.EXE	test	2023-03-02
sigma	HackTool - Bloodhound/Sharphound Execution	test	2023-02-04
sigma	Cisco Collect Data	test	2023-01-04
sigma	Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet	test	2022-10-10
sigma	Net.EXE Execution	test	2022-07-11