Enumerating Users without net, Services without sc and Scheduled Tasks without schtasks
PreviousEnumerating COM Objects and their MethodsNextEnumerating Windows Domains with rpcclient through SocksProxy == Bypassing Command Line Logging
Last updated
Last updated
It is possible to use MMC snap-ins to enumerate local users and local groups, services, scheduled tasks, SMB shares and sessions on a system if you have an interactive desktop session on the compromised system either via RDP or if you are simulating an insider threat during a pentest and you are given a company's laptop.
The use of well known lolbins like net, sc and schtasks on a host where an EDR solution is running is risky and may get you caught. Using snap-ins may help evade commandline detections SOC may be relying on.
Of course, marketing department is unlikely to run mmc snap-ins either, so beware :)
Launch mmc.exe, click File > Add\remove snap-in > Local users and Groups:
Same could be done for enumerating services running on the system:
Note that services.msc could give you the same view.
Persistence anyone? Note that taskschd.msc could give you the same view:
