Skip to content

T1087.002 Domain Account

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.

Commands such as net user /domain and net group /domain of the Net utility, dscacheutil -q group on macOS, and ldapsearch on Linux can list domain users and groups. PowerShell cmdlets including Get-ADUser and Get-ADGroupMember may enumerate members of Active Directory groups.1

Item Value
ID T1087.002
Sub-techniques T1087.001, T1087.002, T1087.003, T1087.004
Tactics TA0007
Platforms Linux, Windows, macOS
Version 1.2
Created 21 February 2020
Last Modified 24 October 2025

Procedure Examples

ID Name Description
S0552 AdFind AdFind can enumerate domain users.1418161517
G0096 APT41 APT41 used built-in net commands to enumerate domain administrator users.40
S0239 Bankshot Bankshot gathers domain and account names/information through process monitoring.33
S0534 Bazar Bazar has the ability to identify domain administrator accounts.2122
G1043 BlackByte BlackByte has used tools such as AdFind to identify and enumerate domain accounts.59
S1068 BlackCat BlackCat can utilize net use commands to identify domain users.26
S0521 BloodHound BloodHound can collect information about domain users, including identification of domain admin accounts.7
S0635 BoomBox BoomBox has the ability to execute an LDAP query to enumerate the distinguished name, SAM account name, and display name for all domain users.25
G0060 BRONZE BUTLER BRONZE BUTLER has used net user /domain to identify account information.71
S1063 Brute Ratel C4 Brute Ratel C4 can use LDAP queries, net group "Domain Admins" /domain and net user /domain for discovery.1213
G0114 Chimera Chimera has has used net user /dom and net user Administrator to enumerate domain accounts including administrator accounts.5354
S0154 Cobalt Strike Cobalt Strike can determine if the user on an infected machine is in the admin or domain admin group.29
S0488 CrackMapExec CrackMapExec can enumerate the domain user accounts on a targeted system.4
G0035 Dragonfly Dragonfly has used batch scripts to enumerate users on a victim domain controller.72
S0105 dsquery dsquery can be used to gather information on user accounts within a domain.56
S1159 DUSTTRAP DUSTTRAP can enumerate domain accounts.19
S0363 Empire Empire can acquire local and domain user account information.89
G1016 FIN13 FIN13 can identify user accounts associated with a Service Principal Name and query Service Principal Names within the domain by utilizing the following scripts: GetUserSPNs.vbs and querySpn.vbs.3837
G0037 FIN6 FIN6 has used Metasploit’s PsExec NTDSGRAB module to obtain a copy of the victim’s Active Directory database.39
G0046 FIN7 FIN7 has used the PowerShell script 3CF9.ps1 and the executable WsTaskLoad to enumerate domain administrations by executing net group “Domain Admins” /domain.62 FIN7 has also used csvde.exe, which is a built-in Windows command line tool, to export Active Directory information.
G0117 Fox Kitten Fox Kitten has used the Softerra LDAP browser to browse documentation on service accounts.61
S1022 IceApple The IceApple Active Directory Querier module can perform authenticated requests against an Active Directory server.35
S0483 IcedID IcedID can query LDAP and can use built-in net commands to identify additional users on the network to infect.3130
G1032 INC Ransom INC Ransom has scanned for domain admin accounts in compromised environments.50
G0004 Ke3chang Ke3chang performs account discovery using commands such as net localgroup administrators and net group “REDACTED” /domain on specific permissions groups.41
G1004 LAPSUS$ LAPSUS$ has used the AD Explorer tool to enumerate users on a victim’s network.5251
S1160 Latrodectus Latrodectus can run C:\Windows\System32\cmd.exe /c net group "Domain Admins" /domain to identify domain administrator accounts.36
G0030 Lotus Blossom Lotus Blossom has used net commands and tools such as AdFind to profile domain accounts associated with victim machines and make Active Directory queries.4748
G0045 menuPass menuPass has used the Microsoft administration tool csvde.exe to export Active Directory data.55
S1146 MgBot MgBot includes modules for collecting information on Active Directory domain accounts.23
G0069 MuddyWater MuddyWater has used cmd.exe net user /domain to enumerate domain users.49
G0129 Mustang Panda Mustang Panda has utilized AdFind to identify domain users.46
S0039 Net Net commands used with the /domain flag can be used to gather information about and manipulate user accounts on the current domain.3
G0049 OilRig OilRig has run net user, net user /domain, net group “domain admins” /domain, and net group “Exchange Trusted Subsystem” /domain to get account listings on a victim.56
C0012 Operation CuckooBees During Operation CuckooBees, the threat actors used the dsquery and dsget commands to get domain environment information and to query users in administrative groups.74
C0022 Operation Dream Job During Operation Dream Job, Lazarus Group queried compromised victim’s active directory servers to obtain the list of employees including administrator accounts.76
C0014 Operation Wocao During Operation Wocao, threat actors used the net command to retrieve information about domain accounts.75
S0165 OSInfo OSInfo enumerates local and domain users32
G0033 Poseidon Group Poseidon Group searches for administrator accounts on both the local victim machine and the network.63
S0378 PoshC2 PoshC2 can enumerate local and domain user account information.10
S0184 POWRUNER POWRUNER may collect user account information by running net user /domain or a series of other commands on a victim.27
G1039 RedCurl RedCurl has collected information about domain accounts using SysInternal’s AdExplorer functionality .6465
G0034 Sandworm Team Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about usernames listed in AD.70
G1015 Scattered Spider Scattered Spider has enumerated legitimate domain accounts which are used in the targeted environment.43454244
S0692 SILENTTRINITY SILENTTRINITY can use System.Security.AccessControl namespaces to retrieve domain user information.11
C0024 SolarWinds Compromise During the SolarWinds Compromise, APT29 used PowerShell to discover domain accounts by exectuing Get-ADUser and Get-ADGroupMember.173
S0516 SoreFang SoreFang can enumerate domain accounts via net.exe user /domain.20
G1053 Storm-0501 Storm-0501 has utilized an obfuscated version of the Active Directory reconnaissance tool ADRecon.ps1 (obfs.ps1 or recon.ps1) to discover domain accounts.67
G1046 Storm-1811 Storm-1811 has performed domain account enumeration during intrusions.66
S0603 Stuxnet Stuxnet enumerates user accounts of the domain.28
S0018 Sykipot Sykipot may use net group “domain admins” /domain to display accounts in the “domain admins” permissions group and net localgroup “administrators” to list local system administrator group membership.24
G1022 ToddyCat ToddyCat has run net user %USER% /dom for account discovery.57
G0010 Turla Turla has used net user /domain to enumerate domain accounts.58
S0476 Valak Valak has the ability to enumerate domain admin accounts.34
G1017 Volt Typhoon Volt Typhoon has run net group /dom and net group "Domain Admins" /dom in compromised environments for account discovery.6968
G0102 Wizard Spider Wizard Spider has identified domain admins through the use of net group "Domain admins" /DOMAIN. Wizard Spider has also leveraged the PowerShell cmdlet Get-ADComputer to collect account names from Active Directory data.2260

Mitigations

ID Mitigation Description
M1028 Operating System Configuration Prevent administrator accounts from being enumerated when an application is elevating through UAC since it can lead to the disclosure of account names. The Registry key is located at HKLM\ SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\EnumerateAdministrators. It can be disabled through GPO: Computer Configuration > [Policies] > Administrative Templates > Windows Components > Credential User Interface: Enumerate administrator accounts on elevation.2

References

  1. CrowdStrike. (2022, January 27). Early Bird Catches the Wormhole: Observations from the StellarParticle Campaign. Retrieved February 7, 2022. ↩↩

  2. UCF. (n.d.). The system must require username and password to elevate a running application.. Retrieved December 18, 2017. ↩

  3. Microsoft. (2017, February 14). Net Commands On Windows Operating Systems. Retrieved March 19, 2020. ↩

  4. byt3bl33d3r. (2018, September 8). SMB: Command Reference. Retrieved July 17, 2020. ↩

  5. Microsoft. (n.d.). Dsquery. Retrieved April 18, 2016. ↩

  6. Rufus Brown, Van Ta, Douglas Bienstock, Geoff Ackerman, John Wolfram. (2022, March 8). Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments. Retrieved July 8, 2022. ↩

  7. Red Team Labs. (2018, April 24). Hidden Administrative Accounts: BloodHound to the Rescue. Retrieved October 28, 2020. ↩

  8. Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016. ↩

  9. SecureWorks 2019, August 27 LYCEUM Takes Center Stage in Middle East Campaign Retrieved. 2019/11/19  ↩

  10. Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019. ↩

  11. Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022. ↩

  12. Harbison, M. and Renals, P. (2022, July 5). When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors. Retrieved February 1, 2023. ↩

  13. Kenefick, I. et al. (2022, October 12). Black Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike. Retrieved February 6, 2023. ↩

  14. Brian Donohue, Katie Nickels, Paul Michaud, Adina Bodkins, Taylor Chapman, Tony Lambert, Jeff Felling, Kyle Rainey, Mike Haag, Matt Graeber, Aaron Didier.. (2020, October 29). A Bazar start: How one hospital thwarted a Ryuk ransomware outbreak. Retrieved October 30, 2020. ↩

  15. Cybereason. (2022, August 17). Bumblebee Loader – The High Road to Enterprise Domain Control. Retrieved August 29, 2022. ↩

  16. Goody, K., et al (2019, January 11). A Nasty Trick: From Credential Theft Malware to Business Disruption. Retrieved May 12, 2020. ↩

  17. Kamble, V. (2022, June 28). Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem. Retrieved August 24, 2022. ↩

  18. McKeague, B. et al. (2019, April 5). Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware. Retrieved April 17, 2019. ↩

  19. Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024. ↩

  20. CISA. (2020, July 16). MAR-10296782-1.v1 – SOREFANG. Retrieved September 29, 2020. ↩

  21. Pantazopoulos, N. (2020, June 2). In-depth analysis of the new Team9 malware family. Retrieved December 1, 2020. ↩

  22. The DFIR Report. (2020, October 8). Ryuk’s Return. Retrieved October 9, 2020. ↩↩

  23. Threat Hunter Team. (2023, April 20). Daggerfly: APT Actor Targets Telecoms Company in Africa. Retrieved July 25, 2024. ↩

  24. Blasco, J. (2011, December 12). Another Sykipot sample likely targeting US federal agencies. Retrieved March 28, 2016. ↩

  25. MSTIC. (2021, May 28). Breaking down NOBELIUM’s latest early-stage toolset. Retrieved August 4, 2021. ↩

  26. Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022. ↩

  27. Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017. ↩

  28. Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024. ↩

  29. Dahan, A. et al. (2019, December 11). DROPPING ANCHOR: FROM A TRICKBOT INFECTION TO THE DISCOVERY OF THE ANCHOR MALWARE. Retrieved September 10, 2020. ↩

  30. DFIR. (2022, April 25). Quantum Ransomware. Retrieved July 26, 2024. ↩

  31. Kessem, L., et al. (2017, November 13). New Banking Trojan IcedID Discovered by IBM X-Force Research. Retrieved July 14, 2020. ↩

  32. Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016. ↩

  33. Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018. ↩

  34. Salem, E. et al. (2020, May 28). VALAK: MORE THAN MEETS THE EYE . Retrieved June 19, 2020. ↩

  35. CrowdStrike. (2022, May). ICEAPPLE: A NOVEL INTERNET INFORMATION SERVICES (IIS) POST-EXPLOITATION FRAMEWORK. Retrieved June 27, 2022. ↩

  36. Stepanic, D. and Bousseaden, S. (2024, May 15). Spring Cleaning with LATRODECTUS: A Potential Replacement for ICEDID. Retrieved September 13, 2024. ↩

  37. Sygnia Incident Response Team. (2022, January 5). TG2003: ELEPHANT BEETLE UNCOVERING AN ORGANIZED FINANCIAL-THEFT OPERATION. Retrieved February 9, 2023. ↩

  38. Ta, V., et al. (2022, August 8). FIN13: A Cybercriminal Threat Actor Focused on Mexico. Retrieved February 9, 2023. ↩

  39. FireEye Threat Intelligence. (2016, April). Follow the Money: Dissecting the Operations of the Cyber Crime Group FIN6. Retrieved November 17, 2024. ↩

  40. Nikita Rostovcev. (2022, August 18). APT41 World Tour 2021 on a tight schedule. Retrieved February 22, 2024. ↩

  41. Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014. ↩

  42. Counter Adversary Operations. (2025, July 2). CrowdStrike Services Observes SCATTERED SPIDER Escalate Attacks Across Industries. Retrieved October 13, 2025. ↩

  43. CISA. (2023, November 16). Cybersecurity Advisory: Scattered Spider (AA23-320A). Retrieved March 18, 2024. ↩

  44. Mandiant Incident Response. (2025, July 23). From Help Desk to Hypervisor: Defending Your VMware vSphere Estate from UNC3944. Retrieved October 13, 2025. ↩

  45. Microsoft. (2023, October 25). Octo Tempest crosses boundaries to facilitate extortion, encryption, and destruction. Retrieved March 18, 2024. ↩

  46. Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025. ↩

  47. Joey Chen, Cisco Talos. (2025, February 27). Lotus Blossom espionage group targets multiple industries with different versions of Sagerunex and hacking tools. Retrieved March 15, 2025. ↩

  48. Symntec Threat Hunter Team. (2022, November 12). Billbug: State-sponsored Actor Targets Cert Authority, Government Agencies in Multiple Asian Countries. Retrieved March 15, 2025. ↩

  49. Peretz, A. and Theck, E. (2021, March 5). Earth Vetala – MuddyWater Continues to Target Organizations in the Middle East. Retrieved March 18, 2021. ↩

  50. SOCRadar. (2024, January 24). Dark Web Profile: INC Ransom. Retrieved June 5, 2024. ↩

  51. Brown, D., et al. (2022, April 28). LAPSUS$: Recent techniques, tactics and procedures. Retrieved December 22, 2022. ↩

  52. MSTIC, DART, M365 Defender. (2022, March 24). DEV-0537 Criminal Actor Targeting Organizations for Data Exfiltration and Destruction. Retrieved May 17, 2022. ↩

  53. Cycraft. (2020, April 15). APT Group Chimera - APT Operation Skeleton key Targets Taiwan Semiconductor Vendors. Retrieved August 24, 2020.. ↩

  54. Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024. ↩

  55. PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017. ↩

  56. Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017. ↩

  57. Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024. ↩

  58. Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020. ↩

  59. Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024. ↩

  60. Shilko, J., et al. (2021, October 7). FIN12: The Prolific Ransomware Intrusion Threat Actor That Has Aggressively Pursued Healthcare Targets. Retrieved June 15, 2023. ↩

  61. CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020. ↩

  62. The BlackBerry Research and Intelligence Team. (2024, April 17). Threat Group FIN7 Targets the U.S. Automotive Industry. Retrieved May 1, 2025. ↩

  63. Kaspersky Lab’s Global Research and Analysis Team. (2016, February 9). Poseidon Group: a Targeted Attack Boutique specializing in global cyber-espionage. Retrieved March 16, 2016. ↩

  64. Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024. ↩

  65. Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024. ↩

  66. Microsoft Threat Intelligence. (2024, May 15). Threat actors misusing Quick Assist in social engineering attacks leading to ransomware. Retrieved March 14, 2025. ↩

  67. Microsoft Threat Intelligence. (2024, September 26). Storm-0501: Ransomware attacks expanding to hybrid cloud environments. Retrieved October 19, 2025. ↩

  68. Counter Threat Unit Research Team. (2023, May 24). Chinese Cyberespionage Group BRONZE SILHOUETTE Targets U.S. Government and Defense Organizations. Retrieved July 27, 2023. ↩

  69. NSA et al. (2023, May 24). People’s Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection. Retrieved July 27, 2023. ↩

  70. Cherepanov, A.. (2016, December 13). The rise of TeleBots: Analyzing disruptive KillDisk attacks. Retrieved June 10, 2020. ↩

  71. Counter Threat Unit Research Team. (2017, October 12). BRONZE BUTLER Targets Japanese Enterprises. Retrieved January 4, 2018. ↩

  72. US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018. ↩

  73. Secureworks CTU. (n.d.). IRON RITUAL. Retrieved February 24, 2022. ↩

  74. Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022. ↩

  75. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020. ↩

  76. Breitenbacher, D and Osis, K. (2020, June 17). OPERATION IN(TER)CEPTION: Targeted Attacks Against European Aerospace and Military Companies. Retrieved December 20, 2021. ↩