Detection of Local User Enumeration via PowerShell

Adversaries and Red Team operators frequently leverage the native Windows PowerShell Get-LocalUser cmdlet to perform account enumeration during the discovery phase of an attack. This activity is a common precursor to lateral movement, privilege escalation, or targeting of specific high-value accounts. While this command is a standard administrative utility, its execution in non-administrative contexts or as part of a broader reconnaissance script often indicates malicious activity. Security operations teams should monitor process execution telemetry for powershell.exe command lines containing this specific cmdlet to maintain visibility into internal network discovery efforts.

Impact

Successful local user enumeration allows attackers to identify potential targets for lateral movement and privilege escalation, increasing the risk of unauthorized access to sensitive data and critical system components within the target environment.

Recommendation

Deploy the following Sigma rule to monitor for Get-LocalUser execution in environments where such activity is not expected from standard administrative accounts.

• Ingest Sysmon Event ID 1 or Windows Security Event ID 4688 into your SIEM and map to the CIM Endpoint data model.
• Tune alerts by filtering known administrative service accounts or common management scripts that legitimately query local user databases.