T1087.002 Domain Account
Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.
Commands such as net user /domain
and net group /domain
of the Net utility, dscacheutil -q group
on macOS, and ldapsearch
on Linux can list domain users and groups. PowerShell cmdlets including Get-ADUser
and Get-ADGroupMember
may enumerate members of Active Directory groups.
Item | Value |
---|---|
ID | T1087.002 |
Sub-techniques | T1087.001, T1087.002, T1087.003, T1087.004 |
Tactics | TA0007 |
Platforms | Linux, Windows, macOS |
Version | 1.2 |
Created | 21 February 2020 |
Last Modified | 15 April 2023 |
Procedure Examples
ID | Name | Description |
---|---|---|
S0552 | AdFind | AdFind can enumerate domain users.913111012 |
S0239 | Bankshot | Bankshot gathers domain and account names/information through process monitoring.24 |
S0534 | Bazar | Bazar has the ability to identify domain administrator accounts.1819 |
S1068 | BlackCat | BlackCat can utilize net use commands to identify domain users.22 |
S0521 | BloodHound | BloodHound can collect information about domain users, including identification of domain admin accounts.16 |
S0635 | BoomBox | BoomBox has the ability to execute an LDAP query to enumerate the distinguished name, SAM account name, and display name for all domain users.28 |
G0060 | BRONZE BUTLER | BRONZE BUTLER has used net user /domain to identify account information.33 |
S1063 | Brute Ratel C4 | Brute Ratel C4 can use LDAP queries, net group "Domain Admins" /domain and net user /domain for discovery.67 |
G0114 | Chimera | Chimera has has used net user /dom and net user Administrator to enumerate domain accounts including administrator accounts.4142 |
S0154 | Cobalt Strike | Cobalt Strike can determine if the user on an infected machine is in the admin or domain admin group.21 |
S0488 | CrackMapExec | CrackMapExec can enumerate the domain user accounts on a targeted system.8 |
G0035 | Dragonfly | Dragonfly has used batch scripts to enumerate users on a victim domain controller.43 |
S0105 | dsquery | dsquery can be used to gather information on user accounts within a domain.1415 |
S0363 | Empire | Empire can acquire local and domain user account information.34 |
G0037 | FIN6 | FIN6 has used Metasploit’s PsExec NTDSGRAB module to obtain a copy of the victim’s Active Directory database.38 |
G0117 | Fox Kitten | Fox Kitten has used the Softerra LDAP browser to browse documentation on service accounts.44 |
S1022 | IceApple | The IceApple Active Directory Querier module can perform authenticated requests against an Active Directory server.25 |
S0483 | IcedID | IcedID can query LDAP to identify additional users on the network to infect.30 |
G0004 | Ke3chang | Ke3chang performs account discovery using commands such as net localgroup administrators and net group “REDACTED” /domain on specific permissions groups.39 |
G1004 | LAPSUS$ | LAPSUS$ has used the AD Explorer tool to enumerate users on a victim’s network.32 |
G0045 | menuPass | menuPass has used the Microsoft administration tool csvde.exe to export Active Directory data.36 |
G0069 | MuddyWater | MuddyWater has used cmd.exe net user /domain to enumerate domain users.34 |
S0039 | Net | Net commands used with the /domain flag can be used to gather information about and manipulate user accounts on the current domain.2 |
G0049 | OilRig | OilRig has run net user , net user /domain , net group “domain admins” /domain , and net group “Exchange Trusted Subsystem” /domain to get account listings on a victim.40 |
C0012 | Operation CuckooBees | During Operation CuckooBees, the threat actors used the dsquery and dsget commands to get domain environment information and to query users in administrative groups.46 |
C0022 | Operation Dream Job | During Operation Dream Job, Lazarus Group queried compromised victim’s active directory servers to obtain the list of employees including administrator accounts.47 |
C0014 | Operation Wocao | During Operation Wocao, threat actors used the net command to retrieve information about domain accounts.48 |
S0165 | OSInfo | OSInfo enumerates local and domain users27 |
G0033 | Poseidon Group | Poseidon Group searches for administrator accounts on both the local victim machine and the network.37 |
S0378 | PoshC2 | PoshC2 can enumerate local and domain user account information.17 |
S0184 | POWRUNER | POWRUNER may collect user account information by running net user /domain or a series of other commands on a victim.29 |
G0034 | Sandworm Team | Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about usernames listed in AD.45 |
S0692 | SILENTTRINITY | SILENTTRINITY can use System.Security.AccessControl namespaces to retrieve domain user information.5 |
C0024 | SolarWinds Compromise | During the SolarWinds Compromise, APT29 used PowerShell to discover domain accounts by exectuing Get-ADUser and Get-ADGroupMember .4950 |
S0516 | SoreFang | SoreFang can enumerate domain accounts via net.exe user /domain .31 |
S0603 | Stuxnet | Stuxnet enumerates user accounts of the domain.20 |
S0018 | Sykipot | Sykipot may use net group “domain admins” /domain to display accounts in the “domain admins” permissions group and net localgroup “administrators” to list local system administrator group membership.26 |
G0010 | Turla | Turla has used net user /domain to enumerate domain accounts.35 |
S0476 | Valak | Valak has the ability to enumerate domain admin accounts.23 |
G0102 | Wizard Spider | Wizard Spider has identified domain admins through the use of “net group ‘Domain admins’” commands.19 |
Mitigations
ID | Mitigation | Description |
---|---|---|
M1028 | Operating System Configuration | Prevent administrator accounts from being enumerated when an application is elevating through UAC since it can lead to the disclosure of account names. The Registry key is located at HKLM\ SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\EnumerateAdministrators . It can be disabled through GPO: Computer Configuration > [Policies] > Administrative Templates > Windows Components > Credential User Interface: Enumerate administrator accounts on elevation.1 |
Detection
ID | Data Source | Data Component |
---|---|---|
DS0017 | Command | Command Execution |
DS0036 | Group | Group Enumeration |
DS0029 | Network Traffic | Network Traffic Content |
DS0009 | Process | OS API Execution |
References
-
UCF. (n.d.). The system must require username and password to elevate a running application.. Retrieved December 18, 2017. ↩
-
Microsoft. (2017, February 14). Net Commands On Windows Operating Systems. Retrieved March 19, 2020. ↩
-
Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016. ↩
-
SecureWorks 2019, August 27 LYCEUM Takes Center Stage in Middle East Campaign Retrieved. 2019/11/19 ↩
-
Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022. ↩
-
Harbison, M. and Renals, P. (2022, July 5). When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors. Retrieved February 1, 2023. ↩
-
Kenefick, I. et al. (2022, October 12). Black Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike. Retrieved February 6, 2023. ↩
-
byt3bl33d3r. (2018, September 8). SMB: Command Reference. Retrieved July 17, 2020. ↩
-
Brian Donohue, Katie Nickels, Paul Michaud, Adina Bodkins, Taylor Chapman, Tony Lambert, Jeff Felling, Kyle Rainey, Mike Haag, Matt Graeber, Aaron Didier.. (2020, October 29). A Bazar start: How one hospital thwarted a Ryuk ransomware outbreak. Retrieved October 30, 2020. ↩
-
Cybereason. (2022, August 17). Bumblebee Loader – The High Road to Enterprise Domain Control. Retrieved August 29, 2022. ↩
-
Goody, K., et al (2019, January 11). A Nasty Trick: From Credential Theft Malware to Business Disruption. Retrieved May 12, 2020. ↩
-
Kamble, V. (2022, June 28). Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem. Retrieved August 24, 2022. ↩
-
McKeague, B. et al. (2019, April 5). Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware. Retrieved April 17, 2019. ↩
-
Rufus Brown, Van Ta, Douglas Bienstock, Geoff Ackerman, John Wolfram. (2022, March 8). Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments. Retrieved July 8, 2022. ↩
-
Red Team Labs. (2018, April 24). Hidden Administrative Accounts: BloodHound to the Rescue. Retrieved October 28, 2020. ↩
-
Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019. ↩
-
Pantazopoulos, N. (2020, June 2). In-depth analysis of the new Team9 malware family. Retrieved December 1, 2020. ↩
-
The DFIR Report. (2020, October 8). Ryuk’s Return. Retrieved October 9, 2020. ↩↩
-
Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved. 2017/09/22 ↩
-
Dahan, A. et al. (2019, December 11). DROPPING ANCHOR: FROM A TRICKBOT INFECTION TO THE DISCOVERY OF THE ANCHOR MALWARE. Retrieved September 10, 2020. ↩
-
Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022. ↩
-
Salem, E. et al. (2020, May 28). VALAK: MORE THAN MEETS THE EYE . Retrieved June 19, 2020. ↩
-
Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018. ↩
-
CrowdStrike. (2022, May). ICEAPPLE: A NOVEL INTERNET INFORMATION SERVICES (IIS) POST-EXPLOITATION FRAMEWORK. Retrieved June 27, 2022. ↩
-
Blasco, J. (2011, December 12). Another Sykipot sample likely targeting US federal agencies. Retrieved March 28, 2016. ↩
-
Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016. ↩
-
MSTIC. (2021, May 28). Breaking down NOBELIUM’s latest early-stage toolset. Retrieved August 4, 2021. ↩
-
Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017. ↩
-
Kessem, L., et al. (2017, November 13). New Banking Trojan IcedID Discovered by IBM X-Force Research. Retrieved July 14, 2020. ↩
-
CISA. (2020, July 16). MAR-10296782-1.v1 – SOREFANG. Retrieved September 29, 2020. ↩
-
MSTIC, DART, M365 Defender. (2022, March 24). DEV-0537 Criminal Actor Targeting Organizations for Data Exfiltration and Destruction. Retrieved May 17, 2022. ↩
-
Counter Threat Unit Research Team. (2017, October 12). BRONZE BUTLER Targets Japanese Enterprises. Retrieved January 4, 2018. ↩
-
Peretz, A. and Theck, E. (2021, March 5). Earth Vetala – MuddyWater Continues to Target Organizations in the Middle East. Retrieved March 18, 2021. ↩
-
Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020. ↩
-
PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017. ↩
-
Kaspersky Lab’s Global Research and Analysis Team. (2016, February 9). Poseidon Group: a Targeted Attack Boutique specializing in global cyber-espionage. Retrieved March 16, 2016. ↩
-
FireEye Threat Intelligence. (2016, April). Follow the Money: Dissecting the Operations of the Cyber Crime Group FIN6. Retrieved June 1, 2016. ↩
-
Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014. ↩
-
Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017. ↩
-
Cycraft. (2020, April 15). APT Group Chimera - APT Operation Skeleton key Targets Taiwan Semiconductor Vendors. Retrieved August 24, 2020. ↩
-
Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved January 19, 2021. ↩
-
US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018. ↩
-
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020. ↩
-
Cherepanov, A.. (2016, December 13). The rise of TeleBots: Analyzing disruptive KillDisk attacks. Retrieved June 10, 2020. ↩
-
Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022. ↩
-
Breitenbacher, D and Osis, K. (2020, June 17). OPERATION IN(TER)CEPTION: Targeted Attacks Against European Aerospace and Military Companies. Retrieved December 20, 2021. ↩
-
Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020. ↩
-
CrowdStrike. (2022, January 27). Early Bird Catches the Wormhole: Observations from the StellarParticle Campaign. Retrieved February 7, 2022. ↩
-
Secureworks CTU. (n.d.). IRON RITUAL. Retrieved February 24, 2022. ↩
-
Stepanic, D.. (2020, January 13). Embracing offensive tooling: Building detections against Koadic using EQL. Retrieved November 30, 2020. ↩