Account Discovery: Local Account

Threat Actors may attempt to get a listing of local system accounts. This information can help Threat Actors determine which local accounts exist on a system to aid in follow-on behavior.

ID: ATAGS-T1127.001
Sub-technique of:  ATAGS-T1127
Tactic: Discovery
Targeted Components: Mission, Personnel & Identity
Responsibility: Shared
Created: 18 April 2026
Last Modified: 18 April 2026

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.