# User Hunting

While user hunting, it creates a spike in network while fuzzing and also creates **4624 - LogOn Event** & **4634 - LogOff Event** on each machines while enumerating

### Find-LocalAdminAccess

Find all machines on the current/given domain, where the current user has local admin access (Performs multi threaded queries on list of computers from current domain *Get-NetComputer* using *Invoke-CheckLocalAdminAccess*)

```
Find-LocalAdminAccess
```

### Find-WMILocalAdminAccess

*Find-LocalAdminAccess* uses ports like RPC and SMB which can be blocked by firewall sometimes

To overcome that, we can use WMI queries to enumerate local admin access

```
Find-WMILocalAdminAccess -ComputerFile <List of Computers> 
```

WMI query need local admin privilege to execute, so we can probe the WMI query into computers to check the execution to determine the local admin rights

### Enumerating Local Admin

To find local admins on all machines of the domain (Needs admin privs on Non-DC machines)

```
Invoke-EnumerateLocalAdmin
```

Find all machines on the current/given domain, where the current user has local admin access (Performs multi threaded queries on list of computers from current domain *Get-NetComputer* using *Get-NetLocalGroup*)

### Invoke-UserHunter

It looks for a session of Domain Admin on all the machines , where local admin access is available

Find all sessions on the DOMAIN ADMINS (Default)/given group, where the current user has local admin access (Performs multi threaded queries on list of members using *Get-NetGroupMember* and checks sessions *Get-NetSession* and logged Get-NetLoggedon on users)

```
Invoke-UserHunter

Invoke-UserHunter -GroupName "<GROUP NAME>"
```

To check admin access on that session,

```
Invoke-UserHunter -CheckAccess
```

By performing stealth hunting, it only enumerate high value target machines (DC, File Servers, Distributed File Servers) on a domain (Chance of success is low)

```
Invoke-UserHunter -Stealth
```