Loading story…
MITRE ATT&CK documents widespread adversary use of the Windows net localgroup command—particularly net localgroup administrators—to enumerate local groups and identify accounts with local administrator privileges after compromise. The technique, tracked as T1069.001 (Permission Groups Discovery: Local Groups), appears across numerous intrusion sets and malware families, including OilRig, Turla, Volt Typhoon, Tonto Team, Chimera, and HEXANE, and is also supported by offensive tooling such as BloodHound, Cobalt Strike, PoshC2, and SILENTTRINITY.
Splunk has removed its legacy Net Localgroup Discovery analytic, which detected execution of net localgroup through EDR process telemetry, and replaced it with Windows Group Discovery Via Net (UUID c5c8e0f3-147a-43da-bf04-4cfaec27dc44). The retired rule had been aligned to ATT&CK T1069.001 and was intended to surface attacker reconnaissance that can enable privilege escalation and lateral movement, underscoring continued defender focus on monitoring local group enumeration on Windows systems.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Splunk removed the hunting detection 'Net Localgroup Discovery' from its Threat Research content library, stating it is no longer maintained or supported. The company said the analytic was deprecated in favor of the replacement detection 'Windows Group Discovery Via Net' (UUID c5c8e0f3-147a-43da-bf04-4cfaec27dc44).
MITRE ATT&CK documents the Local Groups Discovery sub-technique T1069.001, including examples of threat actors, malware, and tools using commands such as `net localgroup administrators` to enumerate local groups and privileged accounts on compromised systems.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
MITRE ATT&CK documents **local account creation** as a common persistence technique under `T1136.001`, describing how threat groups and malware have created or enabled accounts on compromised Windows systems to maintain access and support lateral movement. Reported activity includes use of built-in commands such as `net user` to add accounts, sometimes followed by placement into privileged groups, with examples ranging from generic support-style usernames to attacker-controlled administrator accounts. Splunk published and later replaced a detection for this behavior that monitors endpoint process telemetry for `net.exe` or `net1.exe` creating local administrator accounts with the `/add` parameter and administrator-group keywords. The analytic, now superseded by **Windows Create Local Administrator Account Via Net**, is mapped to ATT&CK `T1136.001` and is intended to help defenders spot suspicious account creation, while noting that legitimate IT administration can generate false positives.
Aug 12, 2026
Splunk has removed two Windows discovery analytics from its Threat Research content library and replaced them with updated detections for attacker use of built-in `net` commands to enumerate users and groups. The deprecated rules, **Local Account Discovery with Net** and **Net Localgroup Discovery**, identified execution of `net.exe` or `net1.exe` with arguments such as `user`, `users`, and `localgroup`, activity commonly used to list local accounts and group memberships on compromised hosts. The changes align with well-documented adversary behavior in **MITRE ATT&CK** techniques `T1087.001` and `T1069.001`, where threat actors use commands like `net user`, `net user /domain`, and `net localgroup administrators` to gather account and privilege information that can support privilege escalation and lateral movement. Splunk said the removed analytics were deprecated in version `5.2.0` in favor of **Windows User Discovery Via Net** and **Windows Group Discovery Via Net**, with the original detections having relied on EDR process telemetry, Sysmon `Event ID 1`, Windows Security `Event ID 4688`, and related endpoint data sources.
Aug 12, 2026
Splunk has removed its deprecated **"Network Connection Discovery With Net"** analytic and replaced it with **"Windows Network Connection Discovery Via Net"**, updating the detection logic for suspicious use of `net.exe` and `net1.exe` on Windows systems. The analytic is designed to surface command-line activity associated with **MITRE ATT&CK `T1049`**, which covers adversary reconnaissance of active network connections, open ports, sessions, and reachable resources after initial compromise. MITRE documents `T1049` as a common post-compromise behavior used by APT groups, ransomware operators, and malware families to map local network connectivity through utilities such as `netstat`, `net use`, and `net session`, as well as Windows networking APIs. Splunk said the detection relies on telemetry including **Sysmon Event ID 1**, **Windows Security Event ID 4688**, and **CrowdStrike ProcessRollup2** normalized into the Splunk Endpoint data model, and noted that while the activity can indicate reconnaissance supporting lateral movement or data exfiltration, administrators may also trigger it during legitimate troubleshooting.
Aug 12, 2026