Procedure examples

BoomBox has the ability to execute an LDAP query to enumerate the distinguished name, SAM account name, and display name for all domain users.

LAMEHUG can use dsquery to enumerate domain user information.

The IceApple Active Directory Querier module can perform authenticated requests against an Active Directory server.

Qilin can use PowerShell cmdlets to enumerate domain users.

SoreFang can enumerate domain accounts via net.exe user /domain.

OSInfo enumerates local and domain users

Net commands used with the /domain flag can be used to gather information about and manipulate user accounts on the current domain.

BloodHound can collect information about domain users, including identification of domain admin accounts.

SILENTTRINITY can use `System.Security.AccessControl` namespaces to retrieve domain user information.

Empire can acquire local and domain user account information.

dsquery can be used to gather information on user accounts within a domain.

PoshC2 can enumerate local and domain user account information.

Brute Ratel C4 can use LDAP queries, `net group "Domain Admins" /domain` and `net user /domain` for discovery.

CrackMapExec can enumerate the domain user accounts on a targeted system.

AdFind can enumerate domain users.

During HomeLand Justice, threat actors used compromised Exchange accounts to search mailboxes for administrator accounts.

During C0027, Scattered Spider accessed Azure AD to identify email addresses.

Sandworm Team used malware to enumerate email settings, including usernames and passwords, from the M.E.Doc application.

TA505 has used the tool EmailStealer to steal and send lists of e-mail addresses to a remote server.

RedCurl has collected information about email accounts.

Magic Hound has used Powershell to discover email accounts.

TrickBot collects email addresses from Outlook.

Backdoor.Oldrea collects address book information from Outlook.

Emotet has been observed leveraging a module that can scrape email addresses from Outlook.

Grandoreiro can parse Outlook .pst files to extract e-mail addresses.

BoomBox can execute an LDAP query to discover e-mail accounts for domain users.

Lizar can collect email accounts from Microsoft Outlook and Mozilla Thunderbird.

Ruler can be used to enumerate Exchange users and dump the GAL.

MailSniper can be used to obtain account names from Exchange and Office 365 using the Get-GlobalAddressList cmdlet.

Kali365 has leveraged an Exchange Admin module that utilizes Graph to enumerate mailboxes in victim environments.

During C0027, Scattered Spider accessed Azure AD to download bulk lists of group members and to identify privileged users, along with the email addresses and AD attributes.

Storm-0501 has conducted enumeration of users, roles, and resources within victim Azure tenants using the tool Azurehound.

APT29 has conducted enumeration of Azure AD accounts.

Pacu can enumerate IAM users, roles, and groups.

AADInternals can enumerate Azure AD users.

ROADTools can enumerate Azure AD users.

Mini Shai-Hulud has enumerated cloud accounts and subscriptions accessible to the targeted identity.

During SharePoint ToolShell Exploitation, threat actors used Fast Reverse Proxy to communicate with C2.

Mustang Panda proxied communication through the Cloudflare CDN service during RedDelta Modified PlugX Infection Chain Operations.

During RedPenguin, UNC3886 used malware capable of establishing a SOCKS proxy connection to a specified IP and port.

For Operation Sharpshooter, the threat actors used the ExpressVPN service to hide their location.

During Operation MidnightEclipse, threat actors used the GO Simple Tunnel reverse proxy tool.

During Salesforce Data Exfiltration, threat actors used Mullvad VPN IPs to proxy voice phishing calls.

During the 2025 Poland Wiper Attacks, the adversaries utilized the rsocx tool identified as `r.exe` and `rsocx.exe` to tunnel within the internal infrastructure using a Reverse SOCKS Proxy.

During Operation Wocao, threat actors used a custom proxy tool called "Agent" which has support for multiple hops.

During C0017, APT41 used the Cloudflare CDN to proxy C2 traffic.

During C0027, Scattered Spider installed the open-source rsocx reverse proxy tool on a targeted ESXi appliance.

Volt Typhoon has used compromised devices and customized versions of open source tools such as FRP (Fast Reverse Proxy), Earthworm, and Impacket to proxy network traffic.

APT41 used a tool called CLASSFON to covertly proxy network communications.

MuddyWater has used NordVPN to proxy phishing emails, making them appear to originate from France.