AN0846
Analytic 0846
Windows
Adversary enumeration of local user accounts using Net.exe, WMI, or PowerShell.
WinEventLog:Sysmon
EventCode=1
[CommandLinePattern]
Detects variations of 'net user', 'net localgroup', 'Get-LocalUser'.
[UserContext]
Restrict monitoring to low-privileged or unexpected users executing enumeration.
[TimeWindow]
Tune for bursts of enumeration commands in short succession.
AN0847
Analytic 0847
Linux
Enumeration of local users or groups via file access (/etc/passwd) or commands like id, groups.
auditd:PATH
PATH
linux:Sysmon
EventCode=1
[AccessedFile]
Monitors sensitive file access such as '/etc/passwd', '/etc/group'.
[ExecutionScope]
Restrict detection to user-initiated sessions or specific parent processes.
AN0848
Analytic 0848
macOS
Enumeration of macOS local users using dscl, id, dscacheutil, or /etc/passwd access.
macos:unifiedlog
None
[CommandLine]
Monitor dscl . list /Users, dscacheutil -q user, id -un.
[InteractiveSession]
Focus on enumeration from non-console users or untrusted apps.
AN0849
Analytic 0849
ESXi
Enumeration of local ESXi accounts using esxcli or vSphere API from unauthorized sessions.
vpxd.log
vCenter Management
esxi:shell
Shell Execution
[CommandPattern]
Look for 'esxcli system account list' and API calls from unusual sources.
[SessionType]
Restrict detection to interactive sessions vs. maintenance/automation jobs.