Procedure examples

LuminousMoth has used malware that scans for files in the Documents, Desktop, and Download folders and in other drives.

APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection. The group also searched a compromised DCCC computer for specific terms.

APT5 has used the BLOODMINE utility to discover files with .css, .jpg, .png, .gif, .ico, .js, and .jsp extensions in Pulse Secure Connect logs.

Fox Kitten has used WizTree to obtain network files and directory listings.

Winnti Group has used a program named ff.exe to search for specific documents on compromised hosts.

Lazarus Group malware can use a common function to identify target files by their extension, and some also enumerate files and directories, including a Destover-like variant that lists files and gathers information for all drives.

Sowbug identified and extracted all Word documents on a server by using a command containing * .doc and *.docx. The actors also searched for documents based on a specific date range and attempted to identify all installed software on a victim.

Velvet Ant has enumerated local files and folders on victim devices.

Inception used a file listing plugin to collect information about file and directories both on local and remote drives.

Play has used the Grixba information stealer to list security files and processes.

Magic Hound malware can list a victim's logical drives and the type, as well the total/free space of the fixed devices. Other malware can list a directory's contents.

FIN13 has used the Windows `dir` command to enumerate files and directories in a victim's network.

ShinyHunters has checked mount points for Oracle PeopleSoft configurations and has checked the process scheduler configuration file psappsrv.cfg. Additionally, ShinyHunters has read WebLogic server XML configurations files (config.xml).

Scattered Spider has identified vSphere administrator accounts.

Aquatic Panda used the last command in Linux environments to identify recently logged-in users on victim machines.

FIN13 has enumerated all users and their roles from a victim's main treasury system.

APT3 has used a tool that can obtain info about local and global group users, power users, and administrators.

admin@338 actors used the following commands following exploitation of a machine with LOWBALL malware to enumerate user accounts: net user >> %temp%\download net user /domain >> %temp%\download

Volt Typhoon has executed `net user` and `quser` to enumerate local account information.

APT41 used built-in net commands to enumerate local administrator groups.

APT32 enumerated administrative users using the commands net localgroup administrators.

Moses Staff has collected the administrator username from a compromised host.

OilRig has run net user, net user /domain, net group “domain admins” /domain, and net group “Exchange Trusted Subsystem” /domain to get account listings on a victim.

Ke3chang performs account discovery using commands such as net localgroup administrators and net group "REDACTED" /domain on specific permissions groups.

APT1 used the commands net localgroup,net user, and net group to find accounts on the system.

Turla has used net user to enumerate local accounts on the system.

Poseidon Group searches for administrator accounts on both the local victim machine and the network.

RedCurl has collected information about local accounts.

Lotus Blossom has used commands such as `net` to profile local system users.

Chimera has used net user for account discovery.

Medusa Group has leveraged `net user` for account discovery.

APT42 has used the PowerShell-based POWERPOST script to collect local account names from the victim machine.

Fox Kitten has accessed ntuser.dat and UserClass.dat on compromised hosts.

Threat Group-3390 has used net user to conduct internal discovery of systems.

BlackByte has used tools such as AdFind to identify and enumerate domain accounts.

Volt Typhoon has run `net group /dom` and `net group "Domain Admins" /dom` in compromised environments for account discovery.

APT41 used built-in net commands to enumerate domain administrator users.

Dragonfly has used batch scripts to enumerate users on a victim domain controller.

menuPass has used the Microsoft administration tool csvde.exe to export Active Directory data.

MuddyWater has used cmd.exe net user /domain to enumerate domain users.

FIN6 has used Metasploit’s PsExec NTDSGRAB module to obtain a copy of the victim's Active Directory database.

Storm-1811 has performed domain account enumeration during intrusions.

FIN7 has used the PowerShell script 3CF9.ps1 and the executable WsTaskLoad to enumerate domain administrations by executing `net group “Domain Admins” /domain`. FIN7 has also used csvde.exe, which is a built-in Windows command line tool, to export Active Directory information.

Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about usernames listed in AD.

Mustang Panda has utilized AdFind to identify domain users.

Scattered Spider has enumerated legitimate domain accounts which are used in the targeted environment.

OilRig has run net user, net user /domain, net group “domain admins” /domain, and net group “Exchange Trusted Subsystem” /domain to get account listings on a victim.

Ke3chang performs account discovery using commands such as net localgroup administrators and net group "REDACTED" /domain on specific permissions groups.

Turla has used net user /domain to enumerate domain accounts.

Storm-0501 has utilized an obfuscated version of the Active Directory reconnaissance tool ADRecon.ps1 (obfs.ps1 or recon.ps1) to discover domain accounts.