T1087 Account Discovery
Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., [Valid Accounts](https://attack.mitre.org/techniques/T1078)). Adversaries may…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- AD Privileged Users or Groups Reconnaissancehightest · windows
- BloodHound Collection Fileshightest · windows
- Chopper Webshell Process Patternhightest · windows
- Discovery Using AzureHoundhightest · azure
- HackTool - Bloodhound/Sharphound Executionhightest · windows
- HackTool - SOAPHound Executionhightest · windows
- HackTool - winPEAS Executionhightest · windows
- Hacktool Rulerhightest · windows
- Malicious PowerShell Commandlets - PoshModulehightest · windows
- Malicious PowerShell Commandlets - ProcessCreationhightest · windows
- Malicious PowerShell Commandlets - ScriptBlockhightest · windows
- Network Reconnaissance Activityhightest · windows
- PUA - AdFind Suspicious Executionhightest · windows
- PUA - Seatbelt Executionhightest · windows
- PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXEhightest · windows
- Potential Pikabot Discovery Activityhightest · windows
- Reconnaissance Activityhightest · windows
- Renamed AdFind Executionhightest · windows
- SharpHound Recon Account Discoveryhightest · rpc_firewall
- Suspicious Active Directory Database Snapshot Via ADExplorerhightest · windows
- Webshell Detection With Command Line Keywordshightest · windows
- Webshell Hacking Activity Patternshightest · windows
- Active Directory Database Snapshot Via ADExplorermediumtest · windows
- Active Directory Structure Export Via Csvde.EXEmediumtest · windows
- Potential AD User Enumeration From Non-Machine Accountmediumtest · windows
Showing 25 of 34.
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.