CyberStack

MITRE ATT&CK / Techniques / T1087.002

Account Discovery: Domain Account

ID
T1087.002
Tactics
TA0007 Discovery
Sub-technique of
T1087 Account Discovery
Platforms
Linux, macOS, Windows
Data sources
Process Creation, Command Execution, Network Traffic Content
Source
attack.mitre.org
MITRE last modified
12 May 2026

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.

Commands such as net user /domain and net group /domain of the Net utility, dscacheutil -q group on macOS, and ldapsearch on Linux can list domain users and groups. PowerShell cmdlets including Get-ADUser and Get-ADGroupMember may enumerate members of Active Directory groups.[2]

Detection

Mitigations (1)

M1028 Operating System Configuration

Prevent administrator accounts from being enumerated when an application is elevating through UAC since it can lead to the disclosure of account names. The Registry key is located at HKLM\ SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\EnumerateAdministrators. It can be disabled through GPO: Computer Configuration > [Policies] > Administrative Templates > Windows Components > Credential User Interface: Enumerate administrator accounts on elevation.[1]

Groups (30)

Software (28)

References

  1. UCF STIG Elevation Account Enumeration
  2. CrowdStrike StellarParticle January 2022