T1087.002sub-technique of T1087 Account Discovery
Domain Account
Linux · macOS · Windows1 piece on this siteT1087.002 on attack.mitre.org
Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges. Commands such as `net user /domain` and `net group /domain` of the Net utility, `dscacheutil -q group` on macOS, and `ldapsearch` on Linux can list domain users and groups.
Practise it
Labs, timelines, evidence packs and tabletop scenarios to work before you need to.
Seventeen hours at Calderbrook: from a password spray to data leaving
A constructed intrusion laid out against the clock and the ATT&CK tactics, following the same four stages as the guided labs. Eleven events, one of them inferred, and one tactic conspicuously missing.
how MITRE says to see it
Domain Account Enumeration Across Platforms
- Adversary enumeration of domain accounts using net.exe, PowerShell, WMI, or LDAP queries from non-domain controllers or non-admin endpoints.
- Domain account enumeration using ldapsearch, samba tools (e.g., 'wbinfo -u'), or winbindd lookups.
- Domain group and user enumeration via dscl or dscacheutil, or queries to directory services from non-admin endpoints.
what reduces it
- M1028 Operating System Configuration. Prevent administrator accounts from being enumerated when an application is elevating through UAC since it can lead to the disclosure of account names. The Registry key is located at `HKLM\ SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\EnumerateAdministrators`.