Users

Gets user info from SAM Registry file

Other Parsers:

• Any tool that queries user info

References:

• N/A

TOML Collection

system = "windows"

[output]
name = "users_collection"
directory = "./tmp"
format = "json"
compress = false
endpoint_id = "6c51b123-1522-4572-9f2a-0bd5abd81b82"
collection_id = 1
output = "local"

[[artifacts]]
artifact_name = "users-windows"
[artifacts.users_windows]
# Optional
# alt_file = "C:\\Artifacts\\SAM"

Collection Options

• alt_file Full path to alternative SAM Registry file. This configuration is optional. By default artemis will parse the SAM Registry file at its default location.

Output Structure

An array of UserInfo entries

export interface UserInfo {
  /**Last logon for account */
  last_logon: string;
  /**Time when password last set */
  password_last_set: string;
  /**Last password failure */
  last_password_failure: string;
  /**Relative ID for account. Typically last number of SID */
  relative_id: number;
  /**Primary group ID for account */
  primary_group_id: number;
  /**UAC flags associated with account */
  user_account_control_flags: string[];
  /**Country code for account */
  country_code: number;
  /**Code page for account */
  code_page: number;
  /**Number of password failures associated with account */
  number_password_failures: number;
  /**Number of logons for account */
  number_logons: number;
  /**Username for account */
  username: string;
  /**SID for account */
  sid: string;
}