windows_administrators

Description

• Local administrator accounts

Configuration

[windows_administrators]
enabled = true

Name	Options	Default	Description
enabled	true/false	true	Plugin status

Returned values

"windows_administrators": [
    {
      "Name": "HOST\\Administrator",
      "ObjectClass": "User"
    },
    {
      "Name": "HOST\\User",
      "ObjectClass": "User"
    }
]

Key	Description
Name	Username
ObjectClass	Account type (User/Group)

MITRE ATT&CK Mapping

• T1136.001 Create Account: Local Account

Authors

• Giovanni Pecoraro (Peco602)