diff --git a/discovery_win_accounts.py b/discovery_win_accounts.py new file mode 100644 index 0000000..c310418 --- /dev/null +++ b/discovery_win_accounts.py @@ -0,0 +1,35 @@ +# Name: Windows Account Discovery +# RTA: discovery_win_accounts.py +# ATT&CK: T1087 +# Description: Account discovery commands via net and wmic + +import common + + +def main(): + common.log("Windows Account Discovery using net.exe and wmic") + commands = [ + 'net.exe group \"Domain Admins\" /domain', + 'net.exe group \"Enterprise Admins\" /domain', + 'net.exe user', + 'net.exe user /domain', + 'net.exe localgroup administrators', + 'net.exe share', + 'net.exe use', + 'net.exe accounts', + 'net.exe config workstation', + 'wmic useraccount list /format:list', + 'wmic ntdomain', + 'wmic group list /format:list', + 'wmic sysaccount list /format:list', + ] + + for cmd in commands: + common.execute(cmd) + + + common.log("Finished Enumerating Account Discovery", log_type="-") + + +if __name__ == "__main__": + exit(main())