dsquery is a command-line utility that can be used to query Active Directory for information from a system within a domain. It is typically installed only on Windows Server versions but can be installed on non-server variants through the Microsoft-provided Remote Server Administration Tools bundle.
| Technique | Procedure example |
|---|---|
| T1069.002 Domain Groups |
dsquery can be used to gather information on permission groups within a domain. |
| T1082 System Information Discovery |
dsquery has the ability to enumerate various information, such as the operating system and host name, for systems within a domain. |
| T1087.002 Domain Account |
dsquery can be used to gather information on user accounts within a domain. |
| T1482 Domain Trust Discovery |
dsquery can be used to gather information on domain trusts with |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
