Procedure examples

BlackByte has used tools such as AdFind to identify and enumerate domain accounts.

Volt Typhoon has run `net group /dom` and `net group "Domain Admins" /dom` in compromised environments for account discovery.

APT41 used built-in net commands to enumerate domain administrator users.

Dragonfly has used batch scripts to enumerate users on a victim domain controller.

menuPass has used the Microsoft administration tool csvde.exe to export Active Directory data.

MuddyWater has used cmd.exe net user /domain to enumerate domain users.

FIN6 has used Metasploit’s PsExec NTDSGRAB module to obtain a copy of the victim's Active Directory database.

Storm-1811 has performed domain account enumeration during intrusions.

FIN7 has used the PowerShell script 3CF9.ps1 and the executable WsTaskLoad to enumerate domain administrations by executing `net group “Domain Admins” /domain`. FIN7 has also used csvde.exe, which is a built-in Windows command line tool, to export Active Directory information.

Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about usernames listed in AD.

Mustang Panda has utilized AdFind to identify domain users.

Scattered Spider has enumerated legitimate domain accounts which are used in the targeted environment.

OilRig has run net user, net user /domain, net group “domain admins” /domain, and net group “Exchange Trusted Subsystem” /domain to get account listings on a victim.

Ke3chang performs account discovery using commands such as net localgroup administrators and net group "REDACTED" /domain on specific permissions groups.

Turla has used net user /domain to enumerate domain accounts.

Storm-0501 has utilized an obfuscated version of the Active Directory reconnaissance tool ADRecon.ps1 (obfs.ps1 or recon.ps1) to discover domain accounts.

Poseidon Group searches for administrator accounts on both the local victim machine and the network.

RedCurl has collected information about domain accounts using SysInternal’s AdExplorer functionality .

Lotus Blossom has used `net` commands and tools such as AdFind to profile domain accounts associated with victim machines and make Active Directory queries.

Chimera has has used net user /dom and net user Administrator to enumerate domain accounts including administrator accounts.

MirrorFace has used native Windows tools to obtain domain user information.

BRONZE BUTLER has used net user /domain to identify account information.

ToddyCat has run `net user %USER% /dom` for account discovery.

Fox Kitten has used the Softerra LDAP browser to browse documentation on service accounts.

INC Ransom has scanned for domain admin accounts in compromised environments.

LAPSUS$ has used the AD Explorer tool to enumerate users on a victim's network.

Wizard Spider has identified domain admins through the use of `net group "Domain admins" /DOMAIN`. Wizard Spider has also leveraged the PowerShell cmdlet `Get-ADComputer` to collect account names from Active Directory data.

VOID MANTICORE has utilized ADRecon to enumerate the active directory environment.

FIN13 can identify user accounts associated with a Service Principal Name and query Service Principal Names within the domain by utilizing the following scripts: `GetUserSPNs.vbs` and `querySpn.vbs`.