Procedure examples

Pupy uses PowerView and Pywerview to perform discovery commands such as net user, net group, net local group, etc.

The discovery modules used with Duqu can collect information on accounts and permissions.

Stuxnet enumerates user accounts of the domain.

POWRUNER may collect user account information by running net user /domain or a series of other commands on a victim.

Bankshot gathers domain and account names/information through process monitoring.

DUSTTRAP can enumerate domain accounts.

RustyWater has gathered the domain membership of the victim machine’s user.

BlackCat can utilize `net use` commands to identify domain users.

IcedID can query LDAP and can use built-in `net` commands to identify additional users on the network to infect.

Sykipot may use net group "domain admins" /domain to display accounts in the "domain admins" permissions group and net localgroup "administrators" to list local system administrator group membership.

Latrodectus can run `C:\Windows\System32\cmd.exe /c net group "Domain Admins" /domain` to identify domain administrator accounts.

Bazar has the ability to identify domain administrator accounts.

MgBot includes modules for collecting information on Active Directory domain accounts.

Cobalt Strike can determine if the user on an infected machine is in the admin or domain admin group.

Valak has the ability to enumerate domain admin accounts.

BoomBox has the ability to execute an LDAP query to enumerate the distinguished name, SAM account name, and display name for all domain users.

LAMEHUG can use dsquery to enumerate domain user information.

The IceApple Active Directory Querier module can perform authenticated requests against an Active Directory server.

Qilin can use PowerShell cmdlets to enumerate domain users.

SoreFang can enumerate domain accounts via net.exe user /domain.

OSInfo enumerates local and domain users

Net commands used with the /domain flag can be used to gather information about and manipulate user accounts on the current domain.

BloodHound can collect information about domain users, including identification of domain admin accounts.

SILENTTRINITY can use `System.Security.AccessControl` namespaces to retrieve domain user information.

Empire can acquire local and domain user account information.

dsquery can be used to gather information on user accounts within a domain.

PoshC2 can enumerate local and domain user account information.

Brute Ratel C4 can use LDAP queries, `net group "Domain Admins" /domain` and `net user /domain` for discovery.

CrackMapExec can enumerate the domain user accounts on a targeted system.

AdFind can enumerate domain users.

TrickBot collects email addresses from Outlook.

Backdoor.Oldrea collects address book information from Outlook.

Emotet has been observed leveraging a module that can scrape email addresses from Outlook.

Grandoreiro can parse Outlook .pst files to extract e-mail addresses.

BoomBox can execute an LDAP query to discover e-mail accounts for domain users.

Lizar can collect email accounts from Microsoft Outlook and Mozilla Thunderbird.

Ruler can be used to enumerate Exchange users and dump the GAL.

MailSniper can be used to obtain account names from Exchange and Office 365 using the Get-GlobalAddressList cmdlet.

Kali365 has leveraged an Exchange Admin module that utilizes Graph to enumerate mailboxes in victim environments.

Pacu can enumerate IAM users, roles, and groups.

AADInternals can enumerate Azure AD users.

ROADTools can enumerate Azure AD users.

Mini Shai-Hulud has enumerated cloud accounts and subscriptions accessible to the targeted identity.

reGeorg can establish an HTTP or SOCKS proxy to tunnel data in and out of a network.

Ursnif has used a peer-to-peer (P2P) network for C2.

RansomHub can use a proxy to connect to remote SFTP servers.

LITTLELAMB.WOOLTEA has the ability to function as a SOCKS proxy.

Havoc has the ability to route HTTP/S communications through designated proxies.

AuditCred can utilize proxy for communications.

RainyDay can use proxy tools including boost_proxy_client for reverse proxy functionality.