Account Discovery

T1087

Technique with 4 sub-techniques.View on attack.mitre.org

About this technique

Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts).

Adversaries may use several methods to enumerate accounts, including abuse of existing tools, built-in commands, and potential misconfigurations that leak account names and roles or permissions in the targeted environment.

For examples, cloud environments typically provide easily accessible interfaces to obtain user lists. On hosts, adversaries can use default PowerShell and other command line functionality to identify accounts. Information about email addresses and accounts may also be extracted by searching an infected system’s files.

Detection rules84

Rules on DetectionCode tagged with T1087 or one of its sub-techniques.

Sigma39

Rule	Level	Log source	Technique
AD Privileged Users or Groups Reconnaissance	high	windows / NULL	T1087.002
BloodHound Collection Files	high	windows / file_event	T1087.001 T1087.002
Chopper Webshell Process Pattern	high	windows / process_creation	T1087
Discovery Using AzureHound	high	azure / NULL	T1087.004
HackTool - Bloodhound/Sharphound Execution	high	windows / process_creation	T1087.001 T1087.002
HackTool - SOAPHound Execution	high	windows / process_creation	T1087
HackTool - winPEAS Execution	high	windows / process_creation	T1087
Hacktool Ruler	high	windows / NULL	T1087
Malicious PowerShell Commandlets - PoshModule	high	windows / ps_module	T1087 T1087.001 T1087.002
Malicious PowerShell Commandlets - ProcessCreation	high	windows / process_creation	T1087 T1087.001 T1087.002
Malicious PowerShell Commandlets - ScriptBlock	high	windows / ps_script	T1087 T1087.001 T1087.002
Network Reconnaissance Activity	high	windows / process_creation	T1087
PUA - AdFind Suspicious Execution	high	windows / process_creation	T1087.002
PUA - Seatbelt Execution	high	windows / process_creation	T1087
PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE	high	windows / process_creation	T1087.002
Reconnaissance Activity	high	windows / NULL	T1087.002
Renamed AdFind Execution	high	windows / process_creation	T1087.002
SharpHound Recon Account Discovery	high	rpc_firewall / application	T1087
Suspicious Active Directory Database Snapshot Via ADExplorer	high	windows / process_creation	T1087.002
Webshell Detection With Command Line Keywords	high	windows / process_creation	T1087
Webshell Hacking Activity Patterns	high	windows / process_creation	T1087
Active Directory Database Snapshot Via ADExplorer	medium	windows / process_creation	T1087.002
Active Directory Structure Export Via Csvde.EXE	medium	windows / process_creation	T1087.002
ADExplorer Writing Complete AD Snapshot Into .dat File	medium	windows / file_event	T1087.002
AWS STS GetCallerIdentity Enumeration Via TruffleHog	medium	aws / NULL	T1087.004
Potential Active Directory Reconnaissance/Enumeration Via LDAP	medium	windows / NULL	T1087.002
Potential AD User Enumeration From Non-Machine Account	medium	windows / NULL	T1087.002
Potentially Suspicious EventLog Recon Activity Using Log Query Utilities	medium	windows / process_creation	T1087
PUA - AdFind.EXE Execution	medium	windows / process_creation	T1087.002
Suspicious Group And Account Reconnaissance Activity Using Net.EXE	medium	windows / process_creation	T1087.001 T1087.002
Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet	medium	windows / process_creation	T1087.001
Suspicious Use of PsLogList	medium	windows / process_creation	T1087 T1087.001 T1087.002
Uncommon Connection to Active Directory Web Services	medium	windows / network_connection	T1087
Active Directory Computers Enumeration With Get-AdComputer	low	windows / ps_script	T1087.002
Cisco Collect Data	low	cisco / NULL	T1087.001
Local Accounts Discovery	low	windows / process_creation	T1087.001
Local System Accounts Discovery - Linux	low	linux / process_creation	T1087.001
Local System Accounts Discovery - MacOs	low	macos / process_creation	T1087.001
RBAC Permission Enumeration Attempt	low	kubernetes / application	T1087.004

Splunk45

Rule	Type	Risk	Data source	Technique
Account Discovery With Net App	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1087.002
AdsiSearcher Account Discovery	TTP	NULL	Powershell Script Block Logging 4104	T1087.002
Azure AD AzureHound UserAgent Detected	TTP	NULL	Azure Active Directory NonInteractiveUserSignInLogs, Azure Active Directory MicrosoftGraphActivityLogs	T1087.004
Azure AD Service Principal Enumeration	TTP	NULL	Azure Active Directory MicrosoftGraphActivityLogs	T1087.004
Detect AzureHound Command-Line Arguments	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1087.001 T1087.002
Detect AzureHound File Modifications	TTP	NULL	Sysmon EventID 11	T1087.001 T1087.002
Detect SharpHound Command-Line Arguments	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1087.001 T1087.002
Detect SharpHound File Modifications	TTP	NULL	Sysmon EventID 11	T1087.001 T1087.002
Detect SharpHound Usage	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1087.001 T1087.002
Domain Account Discovery with Dsquery	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1087.002
Domain Account Discovery With Net App	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1087.002
Domain Account Discovery with Wmic	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1087.002
Enumerate Users Local Group Using Telegram	TTP	NULL	Windows Event Log Security 4798	T1087
Get ADUser with PowerShell	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1087.002
Get ADUser with PowerShell Script Block	Hunting	NULL	Powershell Script Block Logging 4104	T1087.002
Get DomainUser with PowerShell	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1087.002
Get DomainUser with PowerShell Script Block	TTP	NULL	Powershell Script Block Logging 4104	T1087.002
GetLocalUser with PowerShell	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1087.001
GetLocalUser with PowerShell Script Block	Hunting	NULL	Powershell Script Block Logging 4104	T1087.001
GetWmiObject DS User with PowerShell	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1087.002
GetWmiObject DS User with PowerShell Script Block	TTP	NULL	Powershell Script Block Logging 4104	T1087.002
GetWmiObject User Account with PowerShell	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1087.001
GetWmiObject User Account with PowerShell Script Block	Hunting	NULL	Powershell Script Block Logging 4104	T1087.001
Local Account Discovery with Net	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1087.001
Local Account Discovery With Wmic	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1087.001
Network Traffic to Active Directory Web Services Protocol	Hunting	NULL	Sysmon EventID 3	T1087.001 T1087.002
Okta IDP Lifecycle Modifications	Anomaly	NULL	Okta	T1087.004
Okta Unauthorized Access to Application	Anomaly	NULL	Okta	T1087.004
SchCache Change By App Connect And Create ADSI Object	Anomaly	NULL	Sysmon EventID 11	T1087.002
Windows Account Discovery for None Disable User Account	Hunting	NULL	Powershell Script Block Logging 4104	T1087.001
Windows Account Discovery for Sam Account Name	Anomaly	NULL	Powershell Script Block Logging 4104	T1087
Windows Account Discovery With NetUser PreauthNotRequire	Hunting	NULL	Powershell Script Block Logging 4104	T1087
Windows AD Abnormal Object Access Activity	Anomaly	NULL	Windows Event Log Security 4662	T1087.002
Windows AD Privileged Object Access Activity	TTP	NULL	Windows Event Log Security 4662	T1087.002
Windows Domain Account Discovery Via Get-NetComputer	Anomaly	NULL	Powershell Script Block Logging 4104	T1087.002
Windows Find Domain Organizational Units with GetDomainOU	TTP	NULL	Powershell Script Block Logging 4104	T1087.002
Windows Find Interesting ACL with FindInterestingDomainAcl	TTP	NULL	Powershell Script Block Logging 4104	T1087.002
Windows Forest Discovery with GetForestDomain	TTP	NULL	Powershell Script Block Logging 4104	T1087.002
Windows Get Local Admin with FindLocalAdminAccess	TTP	NULL	Powershell Script Block Logging 4104	T1087.002
Windows Linked Policies In ADSI Discovery	Anomaly	NULL	Powershell Script Block Logging 4104	T1087.002
Windows Root Domain linked policies Discovery	Anomaly	NULL	Powershell Script Block Logging 4104	T1087.002
Windows SOAPHound Binary Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1087.001 T1087.002
Windows Special Privileged Logon On Multiple Hosts	TTP	NULL	Windows Event Log Security 4672	T1087
Windows Suspect Process With Authentication Traffic	Anomaly	NULL	Sysmon EventID 3	T1087.002
Windows User Discovery Via Net	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1087.001 T1087.002

Sub-techniques4

ID	Name	Examples
T1087.001	Local Account	65
T1087.002	Domain Account	61
T1087.003	Email Account	15
T1087.004	Cloud Account	7

Groups3

Software5

Havoc ShimRatReporter TONESHELL Woody RAT XCSSET

Campaigns2

Anthropic AI-orchestrated Campaign SolarWinds Compromise

Procedure examples10

Groups3

Used by	Procedure example
GroupAquatic Panda	Aquatic Panda used the `last` command in Linux environments to identify recently logged-in users on victim machines. Crowdstrike HuntReport 2022
GroupFIN13	FIN13 has enumerated all users and their roles from a victim's main treasury system. Mandiant FIN13 Aug 2022
GroupScattered Spider	Scattered Spider has identified vSphere administrator accounts. Mandiant VMware vSphere JUL 2025

Software5

Used by	Procedure example
MalwareHavoc	Havoc can identify privileged user accounts on infected systems. Fortinet Havoc MAR 2025
ToolShimRatReporter	ShimRatReporter listed all non-privileged and privileged accounts available on the machine. FOX-IT May 2016 Mofang
MalwareTONESHELL	TONESHELL included functionality to retrieve a list of user accounts. Zscaler
MalwareWoody RAT	Woody RAT can identify administrator accounts on an infected machine. MalwareBytes WoodyRAT Aug 2022
MalwareXCSSET	XCSSET attempts to discover accounts from various locations such as a user's Evernote, AppleID, Telegram, Skype, and WeChat data. trendmicro xcsset xcode project 2020

Campaigns2

Used by	Procedure example
CampaignAnthropic AI-orchestrated Campaign	During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to query internal database user account tables to enumerate accounts and identify high-privilege accounts within compromised environments. Anthropic AI Orchestrated Campaign NOV 2025
CampaignSolarWinds Compromise	During the SolarWinds Compromise, APT29 obtained a list of users and their roles from an Exchange server using `Get-ManagementRoleAssignment`. Volexity SolarWinds

References2

AWS List Users Open source
Amazon. (n.d.). List Users. Retrieved August 11, 2020.
Google Cloud - IAM Servie Accounts List API Open source
Google. (2020, June 23). gcloud iam service-accounts list. Retrieved August 4, 2020.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.