Account or Group Discovery via Built-In Tools

[metadata]
creation_date = "2023/07/11"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/03/02"

[rule]
author = ["Elastic"]
building_block_type = "default"
description = """
Adversaries may use built-in applications to get a listing of local system or domain accounts and groups.
"""
from = "now-119m"
index = ["logs-endpoint.events.*"]
interval = "60m"
language = "kuery"
license = "Elastic License v2"
name = "Account or Group Discovery via Built-In Tools"
risk_score = 21
rule_id = "f638a66d-3bbf-46b1-a52c-ef6f39fb6caf"
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "OS: macOS",
    "Use Case: Threat Detection",
    "Tactic: Discovery",
    "Rule Type: BBR",
    "Data Source: Elastic Defend",
]
timestamp_override = "event.ingested"
type = "new_terms"
query = '''
event.category:process and host.os.type:(linux or macos) and event.action:exec and (
  (process.name:"dscl" and process.args:(/Active*Directory/* or /Users* or /Groups*)) or
  (process.name:"dscacheutil" and process.args:("user" or "group")) or
  (process.name:"getent" and process.args:("passwd" or "group") and process.args_count >= 3)
) and not (
  process.parent.executable:(
    "/usr/lib/ocf/resource.d/cyanconnode/mysql" or /snap/* or "/usr/bin/check_mk_agent" or "/usr/bin/cloudflared" or
    /opt/puppetlabs/* or /var/lib/snapd/* or "/usr/lib/google/guest_agent/core_plugin" or "/opt/rudder/bin/cf-agent" or
    "/opt/NinjaRMMAgent/programfiles/ninjarmm-linagent"
  ) or
  process.working_directory:(
    /var/snap/* or  "/Applications/NinjaRMMAgent/programfiles/ninjarmm-macagent" or "/var/lib/nanitor/agent" or
    "/var/ossec" or /opt/rapid7/* or "/opt/Tanium/TaniumClient"
  )
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1069"
name = "Permission Groups Discovery"
reference = "https://attack.mitre.org/techniques/T1069/"

[[rule.threat.technique.subtechnique]]
id = "T1069.001"
name = "Local Groups"
reference = "https://attack.mitre.org/techniques/T1069/001/"

[[rule.threat.technique.subtechnique]]
id = "T1069.002"
name = "Domain Groups"
reference = "https://attack.mitre.org/techniques/T1069/002/"

[[rule.threat.technique]]
id = "T1087"
name = "Account Discovery"
reference = "https://attack.mitre.org/techniques/T1087/"

[[rule.threat.technique.subtechnique]]
id = "T1087.001"
name = "Local Account"
reference = "https://attack.mitre.org/techniques/T1087/001/"

[[rule.threat.technique.subtechnique]]
id = "T1087.002"
name = "Domain Account"
reference = "https://attack.mitre.org/techniques/T1087/002/"

[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[rule.new_terms]
field = "new_terms_fields"
value = ["process.parent.executable", "process.command_line", "host.id"]

[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-5d"