t1087-002-domain-account

name	T1087.002_domain-account
description	Adversaries may attempt to get a listing of domain accounts.
category	information-gathering
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1087.002","discovery","linux","macos","windows","sub-technique"]
technique_id	T1087.002
tactic	discovery
all_tactics	["discovery"]
platforms	["Linux","macOS","Windows"]
mitre_url	https://attack.mitre.org/techniques/T1087/002
tech_stack	["linux","macos","windows"]
cwe_ids	["CWE-200"]
chains_with	["T1087","T1087.001","T1087.003","T1087.004"]
prerequisites	["T1087"]
severity_boost	{"T1087":"Chain with T1087 for deeper attack path","T1087.001":"Chain with T1087.001 for deeper attack path","T1087.003":"Chain with T1087.003 for deeper attack path"}

T1087.002 Domain Account

Sub-technique of: T1087

High-Level Description

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.

Commands such as net user /domain and net group /domain of the Net utility, dscacheutil -q group on macOS, and ldapsearch on Linux can list domain users and groups. PowerShell cmdlets including Get-ADUser and Get-ADGroupMember may enumerate members of Active Directory groups.

Kill Chain Phase

• Discovery (TA0007)

Platforms: Linux, macOS, Windows

What to Check

• Identify if Domain Account technique is applicable to target environment
• Check Linux systems for indicators of Domain Account
• Check macOS systems for indicators of Domain Account
• Check Windows systems for indicators of Domain Account
• Verify mitigations are bypassed or absent (1 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Enumerate all accounts (Domain)

Enumerate all accounts Upon exection, multiple enumeration commands will be run and their output displayed in the PowerShell session

Supported Platforms: windows

net user /domain
net group /domain

Atomic Test 2: Enumerate all accounts via PowerShell (Domain)

Enumerate all accounts via PowerShell. Upon execution, lots of user account and group information will be displayed.

Supported Platforms: windows

net user /domain
get-localgroupmember -group Users
get-aduser -filter *

Atomic Test 3: Enumerate logged on users via CMD (Domain)