T1087
Account Discovery
ESXi · IaaS · Identity Provider · Linux · macOS · Office Suite · SaaS · Windows1 piece on this siteT1087 on attack.mitre.org
Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts).
Practise it
Labs, timelines, evidence packs and tabletop scenarios to work before you need to.
TimelineCONSTRUCTED
Seventeen hours at Calderbrook: from a password spray to data leaving
A constructed intrusion laid out against the clock and the ATT&CK tactics, following the same four stages as the guided labs. Eleven events, one of them inferred, and one tactic conspicuously missing.
T1087.002
how MITRE says to see it
Enumeration of User or Account Information Across Platforms
- Detection of processes performing local or domain account enumeration by invoking account directory queries or security APIs followed by structured output of account lists.
- Enumeration of users and groups through suspicious shell commands or unauthorized access to /etc/passwd or /etc/shadow.
- Detection of account enumeration through directory service queries or system utilities accessing account metadata stores, followed by structured enumeration output.
- Detection of enumeration of identity entities through cloud provider APIs where principals retrieve account metadata such as IAM users or roles in rapid succession.
what reduces it
- M1028 Operating System Configuration. Prevent administrator accounts from being enumerated when an application is elevating through UAC since it can lead to the disclosure of account names. The Registry key is located `HKLM\ SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\EnumerateAdministrators`.
- M1018 User Account Management. Manage the creation, modification, use, and permissions associated to user accounts.