Procedure examples

Empire can acquire local and domain user account information.

PoshC2 can enumerate local and domain user account information.

Pupy uses PowerView and Pywerview to perform discovery commands such as net user, net group, net local group, etc.

The discovery modules used with Duqu can collect information on accounts and permissions.

During Operation Dream Job, Lazarus Group queried compromised victim's active directory servers to obtain the list of employees including administrator accounts.

During the SolarWinds Compromise, APT29 used PowerShell to discover domain accounts by exectuing `Get-ADUser` and `Get-ADGroupMember`.

During Operation CuckooBees, the threat actors used the `dsquery` and `dsget` commands to get domain environment information and to query users in administrative groups.

During Operation Wocao, threat actors used the `net` command to retrieve information about domain accounts.

BlackByte has used tools such as AdFind to identify and enumerate domain accounts.

Volt Typhoon has run `net group /dom` and `net group "Domain Admins" /dom` in compromised environments for account discovery.

APT41 used built-in net commands to enumerate domain administrator users.

Dragonfly has used batch scripts to enumerate users on a victim domain controller.

menuPass has used the Microsoft administration tool csvde.exe to export Active Directory data.

MuddyWater has used cmd.exe net user /domain to enumerate domain users.

FIN6 has used Metasploit’s PsExec NTDSGRAB module to obtain a copy of the victim's Active Directory database.

Storm-1811 has performed domain account enumeration during intrusions.

FIN7 has used the PowerShell script 3CF9.ps1 and the executable WsTaskLoad to enumerate domain administrations by executing `net group “Domain Admins” /domain`. FIN7 has also used csvde.exe, which is a built-in Windows command line tool, to export Active Directory information.

Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about usernames listed in AD.

Mustang Panda has utilized AdFind to identify domain users.

Scattered Spider has enumerated legitimate domain accounts which are used in the targeted environment.

OilRig has run net user, net user /domain, net group “domain admins” /domain, and net group “Exchange Trusted Subsystem” /domain to get account listings on a victim.

Ke3chang performs account discovery using commands such as net localgroup administrators and net group "REDACTED" /domain on specific permissions groups.

Turla has used net user /domain to enumerate domain accounts.

Storm-0501 has utilized an obfuscated version of the Active Directory reconnaissance tool ADRecon.ps1 (obfs.ps1 or recon.ps1) to discover domain accounts.

Poseidon Group searches for administrator accounts on both the local victim machine and the network.

RedCurl has collected information about domain accounts using SysInternal’s AdExplorer functionality .

Lotus Blossom has used `net` commands and tools such as AdFind to profile domain accounts associated with victim machines and make Active Directory queries.

Chimera has has used net user /dom and net user Administrator to enumerate domain accounts including administrator accounts.

MirrorFace has used native Windows tools to obtain domain user information.

BRONZE BUTLER has used net user /domain to identify account information.

ToddyCat has run `net user %USER% /dom` for account discovery.

Fox Kitten has used the Softerra LDAP browser to browse documentation on service accounts.

INC Ransom has scanned for domain admin accounts in compromised environments.

LAPSUS$ has used the AD Explorer tool to enumerate users on a victim's network.

Wizard Spider has identified domain admins through the use of `net group "Domain admins" /DOMAIN`. Wizard Spider has also leveraged the PowerShell cmdlet `Get-ADComputer` to collect account names from Active Directory data.

VOID MANTICORE has utilized ADRecon to enumerate the active directory environment.

FIN13 can identify user accounts associated with a Service Principal Name and query Service Principal Names within the domain by utilizing the following scripts: `GetUserSPNs.vbs` and `querySpn.vbs`.

Stuxnet enumerates user accounts of the domain.

POWRUNER may collect user account information by running net user /domain or a series of other commands on a victim.

Bankshot gathers domain and account names/information through process monitoring.

DUSTTRAP can enumerate domain accounts.

RustyWater has gathered the domain membership of the victim machine’s user.

BlackCat can utilize `net use` commands to identify domain users.

IcedID can query LDAP and can use built-in `net` commands to identify additional users on the network to infect.

Sykipot may use net group "domain admins" /domain to display accounts in the "domain admins" permissions group and net localgroup "administrators" to list local system administrator group membership.

Latrodectus can run `C:\Windows\System32\cmd.exe /c net group "Domain Admins" /domain` to identify domain administrator accounts.

Bazar has the ability to identify domain administrator accounts.

MgBot includes modules for collecting information on Active Directory domain accounts.

Cobalt Strike can determine if the user on an infected machine is in the admin or domain admin group.

Valak has the ability to enumerate domain admin accounts.