tfMITRE ATT&CK technique

Account Discovery T1087

Tactic: Discovery
Platforms: ESXi, IaaS, Identity Provider, Linux, macOS, Office Suite, SaaS, Windows
Version: 2.6
Created: 31 May 2017
Last modified: 12 May 2026
Contributors: Daniel Stepanic, Elastic; Microsoft Threat Intelligence Center (MSTIC); Travis Smith, Tripwire

Sub-techniques 486 rules across the family · 21 mapped directly to T1087 · 3 of 4 carry rules

.001Local Account27 .002Domain Account51 .003Email Account0 .004Cloud Account7

Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts).

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups64th pct

Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 17%

Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware66th pct

Tools & malware66th percentile · 66% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 13%

Detection rules87th percentile · 87% of ATT&CK techniques have this many detection rules written or fewer.

Account Discovery MITRE reference T1087

64th pctamong all ATT&CK techniques for number of groups

3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

FIN13G1016 ↗

Has enumerated all users and their roles from a victim's main treasury system.1

created 2023-07-271 referenceaka Elephant Beetle

Scattered SpiderG1015 ↗

Has identified vSphere administrator accounts.1

created 2023-07-051 referenceaka Roasted 0ktapus

Aquatic PandaG0143 ↗

Used the last command in Linux environments to identify recently logged-in users on victim machines.1

created 2022-01-181 reference

All 3 groups for this technique

2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

Anthropic AI-orchestrated CampaignC0062 ↗

During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to query internal database user account tables to enumerate accounts and identify high-privilege accounts within compromised environments.1

2025

SolarWinds CompromiseC0024 ↗

During the SolarWinds Compromise, APT29 obtained a list of users and their roles from an Exchange server using Get-ManagementRoleAssignment.1

2019–2021

All 2 campaigns for this technique

Offense vs defense T1087

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 2Sigma rules (cumulative) · 17Splunk ESCU (cumulative) · 4

first rule: 2017 Q1 · 2 of 2 campaigns plotted

Account Discovery detection strategy DET0587

MITRE names one behaviour worth catching for this technique and breaks it into 8 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Enumeration of User or Account Information Across Platforms

Enterprise

8 platforms

AN1612 · Windows

Detection of processes performing local or domain account enumeration by invoking account directory queries or security APIs followed by structured output of account lists. The defender observes command execution or API invocation patterns that retrieve account information and produce enumeration artifacts shortly afterward.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Group EnumerationDC0099	WinEventLog:Security	EventCode=4798, 4799

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CommandLinePattern	Match variations in enumeration commands like 'net user', 'Get-ADUser', 'dsquery'.
TimeWindow	Short burst of account enumeration commands may indicate automation.
UserContext	Restrict to non-admin accounts or unexpected users executing enumeration commands.

AN1613 · Linux

Enumeration of users and groups through suspicious shell commands or unauthorized access to /etc/passwd or /etc/shadow.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	linux:Sysmon	EventCode=1
File AccessDC0055	auditd:SYSCALL	PATH

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AccessedFile	Tune based on file paths such as '/etc/passwd', '/etc/group', '/etc/shadow'.
ParentProcessName	Filter known admin processes to reduce false positives.

AN1614 · macOS

Detection of account enumeration through directory service queries or system utilities accessing account metadata stores, followed by structured enumeration output.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account MetadataDC0013	macos:unifiedlog	DirectoryService queries retrieving account information
Process CreationDC0032	macos:unifiedlog	process event

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CommandLine	Tune for dscl -list, dscacheutil -q user, id -un, etc.
ExecutionContext	Alert if enumeration is performed in non-console session or by unusual users.

AN1615 · IaaS

Detection of enumeration of identity entities through cloud provider APIs where principals retrieve account metadata such as IAM users or roles in rapid succession.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Cloud Service EnumerationDC0083	AWS:CloudTrail	DescribeUsers / ListUsers / GetUser

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
API_Method	Tune based on which IAM APIs are used and their frequency.
CallerType	Differentiate user-initiated from automated/scripted enumeration.

AN1616 · Identity Provider

Detection of identity directory enumeration through API calls or administrative queries retrieving multiple account objects within a short interval.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account MetadataDC0013	saas:okta	User Enumeration Events
Cloud Service EnumerationDC0083	azure:signinlogs	Graph API Query

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
QueryType	Detect user vs role enumeration. Tune based on query scope.
AppContext	Correlate enumeration with unexpected app registrations or identities.

AN1617 · ESXi

Detection of enumeration activity when system processes query ESXi host account configuration or management APIs to retrieve user account listings.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Command ExecutionDC0064	esxi:vpxd	vCenter Management

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CommandPattern	Tune based on known enumeration commands: 'vim-cmd vimsvc/auth/userlist'.
PrivilegedSession	Elevated enumeration from vpxuser or root may indicate threat activity.

AN1618 · SaaS

Account enumeration via bulk access to user directory features or hidden APIs.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account MetadataDC0013	gcp:audit	Directory API Access

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
EndpointURL	Tune based on enumeration from directory endpoints such as /users, /groups.
UserAgent	Detect scripted enumeration via curl/wget or unknown tools.

AN1619 · Office Suite

Account discovery via VBA macros, COM objects, or embedded scripting.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Script ExecutionDC0029	m365:unified	Scripted Activity

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MacroName	Alert on auto-running macros accessing directory or user info.
ExecutionScope	Focus on macros invoking LDAP, ADODB, or WMI queries.

Operating System ConfigurationM1028

Prevent administrator accounts from being enumerated when an application is elevating through UAC since it can lead to the disclosure of account names. The Registry key is located HKLM\ SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\EnumerateAdministrators. It can be disabled through GPO: Computer Configuration > [Policies] > Administrative Templates > Windows Components > Credential User Interface: E numerate administrator accounts on elevation.

User Account ManagementM1018

Manage the creation, modification, use, and permissions associated to user accounts.

Account Discovery detections T1087

21 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 13%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs