Domain Account

T1087.002

Sub-technique of T1087 Account Discovery.View on attack.mitre.org

About this technique

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.

Commands such as net user /domain and net group /domain of the Net utility, dscacheutil -q group on macOS, and ldapsearch on Linux can list domain users and groups. PowerShell cmdlets including Get-ADUser and Get-ADGroupMember may enumerate members of Active Directory groups.

Detection rules50

Rules on DetectionCode tagged with T1087.002.

Sigma20

Rule	Level	Log source
AD Privileged Users or Groups Reconnaissance	high	windows / NULL
BloodHound Collection Files	high	windows / file_event
HackTool - Bloodhound/Sharphound Execution	high	windows / process_creation
Malicious PowerShell Commandlets - PoshModule	high	windows / ps_module
Malicious PowerShell Commandlets - ProcessCreation	high	windows / process_creation
Malicious PowerShell Commandlets - ScriptBlock	high	windows / ps_script
PUA - AdFind Suspicious Execution	high	windows / process_creation
PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE	high	windows / process_creation
Reconnaissance Activity	high	windows / NULL
Renamed AdFind Execution	high	windows / process_creation
Suspicious Active Directory Database Snapshot Via ADExplorer	high	windows / process_creation
Active Directory Database Snapshot Via ADExplorer	medium	windows / process_creation
Active Directory Structure Export Via Csvde.EXE	medium	windows / process_creation
ADExplorer Writing Complete AD Snapshot Into .dat File	medium	windows / file_event
Potential Active Directory Reconnaissance/Enumeration Via LDAP	medium	windows / NULL
Potential AD User Enumeration From Non-Machine Account	medium	windows / NULL
PUA - AdFind.EXE Execution	medium	windows / process_creation
Suspicious Group And Account Reconnaissance Activity Using Net.EXE	medium	windows / process_creation
Suspicious Use of PsLogList	medium	windows / process_creation
Active Directory Computers Enumeration With Get-AdComputer	low	windows / ps_script

Splunk30

Rule	Type	Risk	Data source
Account Discovery With Net App	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
AdsiSearcher Account Discovery	TTP	NULL	Powershell Script Block Logging 4104
Detect AzureHound Command-Line Arguments	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Detect AzureHound File Modifications	TTP	NULL	Sysmon EventID 11
Detect SharpHound Command-Line Arguments	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Detect SharpHound File Modifications	TTP	NULL	Sysmon EventID 11
Detect SharpHound Usage	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Domain Account Discovery with Dsquery	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Domain Account Discovery With Net App	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Domain Account Discovery with Wmic	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Get ADUser with PowerShell	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Get ADUser with PowerShell Script Block	Hunting	NULL	Powershell Script Block Logging 4104
Get DomainUser with PowerShell	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Get DomainUser with PowerShell Script Block	TTP	NULL	Powershell Script Block Logging 4104
GetWmiObject DS User with PowerShell	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
GetWmiObject DS User with PowerShell Script Block	TTP	NULL	Powershell Script Block Logging 4104
Network Traffic to Active Directory Web Services Protocol	Hunting	NULL	Sysmon EventID 3
SchCache Change By App Connect And Create ADSI Object	Anomaly	NULL	Sysmon EventID 11
Windows AD Abnormal Object Access Activity	Anomaly	NULL	Windows Event Log Security 4662
Windows AD Privileged Object Access Activity	TTP	NULL	Windows Event Log Security 4662
Windows Domain Account Discovery Via Get-NetComputer	Anomaly	NULL	Powershell Script Block Logging 4104
Windows Find Domain Organizational Units with GetDomainOU	TTP	NULL	Powershell Script Block Logging 4104
Windows Find Interesting ACL with FindInterestingDomainAcl	TTP	NULL	Powershell Script Block Logging 4104
Windows Forest Discovery with GetForestDomain	TTP	NULL	Powershell Script Block Logging 4104
Windows Get Local Admin with FindLocalAdminAccess	TTP	NULL	Powershell Script Block Logging 4104
Windows Linked Policies In ADSI Discovery	Anomaly	NULL	Powershell Script Block Logging 4104
Windows Root Domain linked policies Discovery	Anomaly	NULL	Powershell Script Block Logging 4104
Windows SOAPHound Binary Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Suspect Process With Authentication Traffic	Anomaly	NULL	Sysmon EventID 3
Windows User Discovery Via Net	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2

Campaigns4

Operation CuckooBees Operation Dream Job Operation Wocao SolarWinds Compromise

Procedure examples61

Groups29

Used by	Procedure example
GroupAPT41	APT41 used built-in `net` commands to enumerate domain administrator users. Rostovcev APT41 2021
GroupBlackByte	BlackByte has used tools such as AdFind to identify and enumerate domain accounts. Microsoft BlackByte 2023
GroupBRONZE BUTLER	BRONZE BUTLER has used `net user /domain` to identify account information. Secureworks BRONZE BUTLER Oct 2017
GroupChimera	Chimera has has used `net user /dom` and `net user Administrator` to enumerate domain accounts including administrator accounts. Cycraft Chimera April 2020 NCC Group Chimera January 2021
GroupDragonfly	Dragonfly has used batch scripts to enumerate users on a victim domain controller. US-CERT TA18-074A
GroupFIN13	FIN13 can identify user accounts associated with a Service Principal Name and query Service Principal Names within the domain by utilizing the following scripts: `GetUserSPNs.vbs` and `querySpn.vbs`. Mandiant FIN13 Aug 2022 Sygnia Elephant Beetle Jan 2022
GroupFIN6	FIN6 has used Metasploit’s PsExec NTDSGRAB module to obtain a copy of the victim's Active Directory database. FireEye FIN6 April 2016
GroupFIN7	FIN7 has used the PowerShell script 3CF9.ps1 and the executable WsTaskLoad to enumerate domain administrations by executing `net group “Domain Admins” /domain`. FIN7 has also used csvde.exe, which is a built-in Windows command line tool, to export Active Directory information. BlackBerry_FIN7_April2024

View all 29 groups examples

Software28

Used by	Procedure example
ToolAdFind	AdFind can enumerate domain users. Cybereason Bumblebee August 2022 FireEye FIN6 Apr 2019 FireEye Ryuk and Trickbot January 2019 Red Canary Hospital Thwarted Ryuk October 2020 Symantec Bumblebee June 2022
MalwareBankshot	Bankshot gathers domain and account names/information through process monitoring. McAfee Bankshot
MalwareBazar	Bazar has the ability to identify domain administrator accounts. DFIR Ryuk's Return October 2020 NCC Group Team9 June 2020
MalwareBlackCat	BlackCat can utilize `net use` commands to identify domain users. Microsoft BlackCat Jun 2022
ToolBloodHound	BloodHound can collect information about domain users, including identification of domain admin accounts. CrowdStrike BloodHound April 2018
MalwareBoomBox	BoomBox has the ability to execute an LDAP query to enumerate the distinguished name, SAM account name, and display name for all domain users. MSTIC Nobelium Toolset May 2021
ToolBrute Ratel C4	Brute Ratel C4 can use LDAP queries, `net group "Domain Admins" /domain` and `net user /domain` for discovery. Palo Alto Brute Ratel July 2022 Trend Micro Black Basta October 2022
MalwareCobalt Strike	Cobalt Strike can determine if the user on an infected machine is in the admin or domain admin group. Cyberreason Anchor December 2019

View all 28 software examples

Campaigns4

Used by	Procedure example
CampaignOperation CuckooBees	During Operation CuckooBees, the threat actors used the `dsquery` and `dsget` commands to get domain environment information and to query users in administrative groups. Cybereason OperationCuckooBees May 2022
CampaignOperation Dream Job	During Operation Dream Job, Lazarus Group queried compromised victim's active directory servers to obtain the list of employees including administrator accounts. ESET Lazarus Jun 2020
CampaignOperation Wocao	During Operation Wocao, threat actors used the `net` command to retrieve information about domain accounts. FoxIT Wocao December 2019
CampaignSolarWinds Compromise	During the SolarWinds Compromise, APT29 used PowerShell to discover domain accounts by exectuing `Get-ADUser` and `Get-ADGroupMember`. CrowdStrike StellarParticle January 2022 Secureworks IRON RITUAL Profile

References1

CrowdStrike StellarParticle January 2022 Open source
CrowdStrike. (2022, January 27). Early Bird Catches the Wormhole: Observations from the StellarParticle Campaign. Retrieved February 7, 2022.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.