Account Discovery: Domain Account (T1087.002)

Tactic: Discovery · Platforms: Linux, macOS, Windows

The interactive view maps 1 detection strategy, 1 mitigation, 29 threat groups, 28 software entries, 4 campaigns to this technique, alongside D3FEND countermeasures and data-component coverage.

Sub-technique of Account Discovery (T1087).

Overview

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.

Commands such as net user /domain and net group /domain of the Net utility, dscacheutil -q group on macOS, and ldapsearch on Linux can list domain users and groups. PowerShell cmdlets including Get-ADUser and Get-ADGroupMember may enumerate members of Active Directory groups.

Explore

• Open T1087.002 in the interactive ATT&CK matrix
• ATT&CK Intelligence View guide
• Official MITRE ATT&CK entry for T1087.002
• Sigma detection rules for MITRE ATT&CK
• Built by Shahrukh Khan