Files
Ares-mythic/documentation-payload/ares/commands/net_localgroup_member.md
Aryma 03d283cf49 refactor(payload): rename apollo to ares and update documentation
This commit renames the Apollo payload type to Ares, moving all associated files and updating documentation accordingly. The change includes:
- Renaming directories from `apollo` to `ares`
- Updating documentation image references
- Maintaining the same code functionality while changing the payload name
- Adding new Ares-specific documentation files
- Removing old Apollo documentation files

The rename is done to reflect the new payload name while preserving all existing functionality.
2026-04-14 14:02:44 +07:00

35 lines
838 B
Markdown

+++
title = "net_localgroup_member"
chapter = false
weight = 103
hidden = false
+++
## Summary
Collect membership of local groups on a specified computer.
### Arguments
#### Group
Name of group to query for membership.
#### Computer (optional)
Specify the computer to collect group information from. This will default to the localhost if one is not supplied.
## Usage
```
net_localgroup_member [computer] [group]
```
![net_localgroup_member command](../images/net_localgroup_member.png)
## MITRE ATT&CK Mapping
- T1590
- T1069
## Detailed Summary
The `net_localgroup_member` command uses `NetLocalGroupGetMembers` Windows API to collect information about local group membership on a specified host. This information includes the member's name, group name, SID, if the member is a group and what computer it was collected from.