Skip to content

S0105 dsquery

dsquery is a command-line utility that can be used to query Active Directory for information from a system within a domain. 1 It is typically installed only on Windows Server versions but can be installed on non-server variants through the Microsoft-provided Remote Server Administration Tools bundle.

Item Value
ID S0105
Associated Names
Type TOOL
Version 1.2
Created 31 May 2017
Last Modified 18 March 2020
Navigation Layer View In ATT&CK® Navigator

Techniques Used

Domain ID Name Use
enterprise T1087 Account Discovery -
enterprise T1087.002 Domain Account dsquery can be used to gather information on user accounts within a domain.1
enterprise T1482 Domain Trust Discovery dsquery can be used to gather information on domain trusts with dsquery * -filter “(objectClass=trustedDomain)” -attr *.2
enterprise T1069 Permission Groups Discovery -
enterprise T1069.002 Domain Groups dsquery can be used to gather information on permission groups within a domain.1

Groups That Use This Software

ID Name References
G0061 FIN8 3
G0116 Operation Wocao 4

References

Back to top