T1087.002 Domain Account
Sub-technique of T1087 Account Discovery
Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges. Commands such as net user /domain and net group /domain of the [Net](https://attack.mitre.org/software/S0039) utility, dscacheutil -q group on macOS, and…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- AD Privileged Users or Groups Reconnaissancehightest · windows
- BloodHound Collection Fileshightest · windows
- HackTool - Bloodhound/Sharphound Executionhightest · windows
- Malicious PowerShell Commandlets - PoshModulehightest · windows
- Malicious PowerShell Commandlets - ProcessCreationhightest · windows
- Malicious PowerShell Commandlets - ScriptBlockhightest · windows
- PUA - AdFind Suspicious Executionhightest · windows
- PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXEhightest · windows
- Reconnaissance Activityhightest · windows
- Renamed AdFind Executionhightest · windows
- Suspicious Active Directory Database Snapshot Via ADExplorerhightest · windows
- Active Directory Database Snapshot Via ADExplorermediumtest · windows
- Active Directory Structure Export Via Csvde.EXEmediumtest · windows
- Potential AD User Enumeration From Non-Machine Accountmediumtest · windows
- Potential Active Directory Reconnaissance/Enumeration Via LDAPmediumtest · windows
- Suspicious Group And Account Reconnaissance Activity Using Net.EXEmediumtest · windows
- Suspicious Use of PsLogListmediumtest · windows
- ADExplorer Writing Complete AD Snapshot Into .dat Filemediumexperimental · windows
- PUA - AdFind.EXE Executionmediumexperimental · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.