T1087.002 · MITRE ATT&CK technique

Domain Account MITRE reference T1087.002

Top 5%of all ATT&CK techniques for number of groups

29 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

VOID MANTICOREG1055 ↗

Has utilized ADRecon to enumerate the active directory environment.1

created 2026-04-201 referenceaka COBALT MYSTIQUE

MirrorFaceG1054 ↗

Has used native Windows tools to obtain domain user information.1

created 2026-04-171 referenceaka Earth Kasha

Storm-0501G1053 ↗

Has utilized an obfuscated version of the Active Directory reconnaissance tool ADRecon.ps1 (obfs.ps1 or recon.ps1) to discover domain accounts.1

created 2025-10-191 reference

Storm-1811G1046 ↗

Has performed domain account enumeration during intrusions.1

created 2025-03-141 reference

BlackByteG1043 ↗

Has used tools such as AdFind to identify and enumerate domain accounts.1

created 2024-12-161 referenceaka Hecamede

RedCurlG1039 ↗

Has collected information about domain accounts using SysInternal’s AdExplorer functionality .1 2

created 2024-09-232 references

All 29 groups for this technique · 6 newest in this preview

4 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

Operation CuckooBeesC0012 ↗

During Operation CuckooBees, the threat actors used the dsquery and dsget commands to get domain environment information and to query users in administrative groups.1

2019–2022

Operation Dream JobC0022 ↗

During Operation Dream Job, Lazarus Group queried compromised victim's active directory servers to obtain the list of employees including administrator accounts.1

2019–2020

SolarWinds CompromiseC0024 ↗

During the SolarWinds Compromise, APT29 used PowerShell to discover domain accounts by exectuing Get-ADUser and Get-ADGroupMember.1 2

2019–2021

Operation WocaoC0014 ↗

During Operation Wocao, threat actors used the net command to retrieve information about domain accounts.1

2017–2019

All 4 campaigns for this technique

28 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

RustyWaterS9037 ↗

Has gathered the domain membership of the victim machine’s user.1   

created 2026-04-21MALWAREcarried by 1 group

LAMEHUGS9035 ↗

Can use dsquery to enumerate domain user information.1

created 2026-04-21MALWAREcarried by 1 group

QilinS1242 ↗

Can use PowerShell cmdlets to enumerate domain users.1

created 2025-09-26MALWAREcarried by 2 groups

LatrodectusS1160 ↗

Can run C:\Windows\System32\cmd.exe /c net group "Domain Admins" /domain to identify domain administrator accounts.1

created 2024-09-16MALWAREcarried by 2 groups

DUSTTRAPS1159 ↗

Can enumerate domain accounts.1

created 2024-09-16MALWAREcarried by 1 group

MgBotS1146 ↗

Includes modules for collecting information on Active Directory domain accounts.1

created 2024-07-25MALWAREcarried by 1 group

All 28 software entries for this technique · 6 newest in this preview

Offense vs defense T1087.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 4Sigma rules (cumulative) · 23Splunk ESCU (cumulative) · 28

first rule: 2017 Q1 · 4 of 4 campaigns plotted

Domain Account detection strategy DET0129

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Domain Account Enumeration Across Platforms

Enterprise

3 platforms

AN0363 · Windows

Adversary enumeration of domain accounts using net.exe, PowerShell, WMI, or LDAP queries from non-domain controllers or non-admin endpoints.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106
Network Traffic ContentDC0085	NSM:Flow	LDAP Bind/Search

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CommandLinePattern	Detect variations of 'net user /domain', 'Get-ADUser', 'Get-ADGroupMember'.
TimeWindow	Tune detection for bursts of enumeration commands or search queries.
SourceHost	Restrict detection to non-DC or non-admin systems where such commands are unexpected.

AN0364 · Linux

Domain account enumeration using ldapsearch, samba tools (e.g., 'wbinfo -u'), or winbindd lookups.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
Command ExecutionDC0064	linuxsyslog	nslcd or winbind logs
Network Traffic ContentDC0085	NSM:Flow	LDAP Query

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ProcessName	Detect suspicious use of ldapsearch, wbinfo, getent passwd, or samba enumeration tools.
LDAPSearchFilter	Tune for high-volume or broad-scope LDAP queries.
UserContext	Apply filters for unexpected users or service accounts executing the behavior.

AN0365 · macOS

Domain group and user enumeration via dscl or dscacheutil, or queries to directory services from non-admin endpoints.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	Process Execution
Command ExecutionDC0064	macos:unifiedlog	DS daemon log entries

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CommandPattern	Match patterns such as 'dscl /Active\ Directory/All\ Domains -list /Users'.
EndpointRole	Flag this activity only on non-directory hosts or non-admin accounts.

2 analytics

Certain commands are frequently used by malicious actors and infrequently used by normal users. By looking for execution of these commands in short periods of time, we can not only see when a malicious user was on the system but also get an idea of what they were doing.

TypeTTPCoverageLowSubmitted2013

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PLA	Process Lineage Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	hostname
process	create	ppid
process	create	exe

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

processes = search Process:Create
reg_processes = filter processes where (exe == "arp.exe" or exe == "at.exe" or exe == "attrib.exe"
 or exe == "cscript.exe" or exe == "dsquery.exe" or exe == "hostname.exe"
 or exe == "ipconfig.exe" or exe == "mimikatz.exe" or exe == "nbstat.exe"
 or exe == "net.exe" or exe == "netsh.exe" or exe == "nslookup.exe"
 or exe == "ping.exe" or exe == "quser.exe" or exe == "qwinsta.exe"
 or exe == "reg.exe" or exe == "runas.exe" or exe == "sc.exe"
 or exe == "schtasks.exe" or exe == "ssh.exe" or exe == "systeminfo.exe"
 or exe == "taskkill.exe" or exe == "telnet.exe" or exe == "tracert.exe"
 or exe == "wscript.exe" or exe == "xcopy.exe")
reg_grouped = group reg by hostname, ppid where(max time between two events is 30 minutes)
output reg_grouped

DNIF version of the above pseudocode.

_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $App=regex(arp\.exe|at\.exe|attrib\.exe|cscript\.exe|dsquery\.exe|hostname\.exe|ipconfig\.exe|mimikatz.exe|nbstat\.exe|net\.exe|netsh\.exe|nslookup\.exe|ping\.exe|quser\.exe|qwinsta\.exe|reg\.exe|runas\.exe|sc\.exe|schtasks\.exe|ssh\.exe|systeminfo\.exe|taskkill\.exe|telnet\.exe|tracert\.exe|wscript\.exe|xcopy\.exe)i group count_unique $App limit 100
>>_agg count
>>_checkif int_compare Count > 1 include

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 image IN ["*\arp.exe", "*\at.exe", "*\attrib.exe", "*\cscript.exe", "*\dsquery.exe", "*\hostname.exe", "*\ipconfig.exe", "*\mimikatz.exe", "*\nbstat.exe", "*\net.exe", "*\netsh.exe", "*\nslookup.exe", "*\ping.exe", "*\quser.exe", "*\qwinsta.exe", "*\reg.exe", "*\runas.exe", "*\sc.exe", "*\schtasks.exe", "*\ssh.exe", "*\systeminfo.exe", "*\taskkill.exe", "*\telnet.exe", "*\tracert.exe", "*\wscript.exe", "*\xcopy.exe"]
| chart count() as cnt by host
| search cnt > 1

Unit tests

CAR’s own validation procedures for this analytic.

Within a command window, execute several of the commands in quick succession.

["ipconfig /all","hostname","systeminfo","reg.exe Query HKLM\\Software\\Microsoft"]

When entering on a host for the first time, an adversary may try to discover information about the host. There are several built-in Windows commands that can be used to learn about the software configurations, active users, administrators, and networking configuration. These commands should be monitored to identify when an adversary is learning information about the system and environment. The information returned may impact choices an adversary can make when establishing persistence, escalating privileges, or moving laterally.

TypeTTPCoverageModerateSubmitted2016

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PSA	Process Spawn Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	command_line
process	create	exe

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

To be effective in deciphering malicious and benign activity, the full command line is essential. Similarly, having information about the parent process can help with making decisions and tuning to an environment.

process = search Process:Create
info_command = filter process where (
 exe == "hostname.exe" or
 exe == "ipconfig.exe" or
 exe == "net.exe" or
 exe == "quser.exe" or
 exe == "qwinsta.exe" or
 exe == "sc" and (command_line match " query" or command_line match " qc")) or
 exe == "systeminfo.exe" or
 exe == "tasklist.exe" or
 exe == "whoami.exe"
)
output info_command

Splunk version of the above pseudocode search.

index=__your_sysmon_index__ EventCode=1 (Image="C:\\Windows\\*\\hostname.exe" OR Image="C:\\Windows\\*\\ipconfig.exe" OR Image="C:\\Windows\\*\\net.exe" OR Image="C:\\Windows\\*\\quser.exe" OR Image="C:\\Windows\\*\\qwinsta.exe" OR (Image="C:\\Windows\\*\\sc.exe" AND (CommandLine="* query *" OR CommandLine="* qc *")) OR Image="C:\\Windows\\*\\systeminfo.exe" OR Image="C:\\Windows\\*\\tasklist.exe" OR Image="C:\\Windows\\*\\whoami.exe")|stats values(Image) as "Images" values(CommandLine) as "Command Lines" by ComputerName

EQL version of the above pseudocode search.

process where subtype.create and
  (process_name == "hostname.exe" or process_name == "ipconfig.exe" or process_name == "net.exe" or process_name == "quser.exe" process_name == "qwinsta.exe" or process_name == "systeminfo.exe" or process_name == "tasklist.exe" or process_name == "whoami.exe" or (process_name == "sc.exe" and (command_line == "* query *" or command_line == "* qc *")))

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 (image in ["*\hostname.exe", "*\ipconfig.exe", "*\net.exe", "*\quser.exe", "*\qwinsta.exe", "*\systeminfo.exe", "*\tasklist.exe", "*\whoami.exe"] OR (image="*\sc.exe" command IN ["* query *", "* qc *"))

Operating System ConfigurationM1028

Prevent administrator accounts from being enumerated when an application is elevating through UAC since it can lead to the disclosure of account names. The Registry key is located at HKLM\ SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\EnumerateAdministrators. It can be disabled through GPO: Computer Configuration > [Policies] > Administrative Templates > Windows Components > Credential User Interface: Enumerate administrator accounts on elevation.

Tests24ExecutorsPowerShell 15 · cmd 7 · sh 2Need elevation0 of 24Have prerequisites9Have cleanup3Platformswindows, linux

#

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

01

Enumerate all accounts (Domain)

windows

cmd

—

02

Enumerate all accounts via PowerShell (Domain)

windows

PowerShell

—

03

Enumerate logged on users via CMD (Domain)

windows

cmd

—

Enumerate logged on users. Upon exeuction, logged on users will be displayed.

Input arguments

Name	Type	Default	Description
computer_name	string	%COMPUTERNAME%	Name of remote system to query

Attack command

query user /SERVER:#{computer_name}

GUIDa19efdd7-2cad-4d1a-85d5-3247e75ac78b

04

Automated AD Recon (ADRecon)

windows

PowerShell

—

1

Yes

ADRecon extracts and combines information about an AD environement into a report. Upon execution, an Excel file with all of the data will be generated and its path will be displayed.

Input arguments

Name	Type	Default	Description
adrecon_path	path	PathToAtomicsFolder\..\ExternalPayloads\ADRecon.ps1	Path of ADRecon.ps1 file

Attack command

Invoke-Expression "#{adrecon_path}"

Cleanup command

Get-ChildItem "PathToAtomicsFolder\..\ExternalPayloads" -Recurse -Force | Where{$_.Name -Match "^ADRecon-Report-"} | Remove-Item -Force -Recurse

Prerequisite

ADRecon must exist on disk at specified location (#{adrecon_path})

Check

if (Test-Path "#{adrecon_path}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest -Uri "https://raw.githubusercontent.com/sense-of-security/ADRecon/38e4abae3e26d0fa87281c1d0c65cabd4d3c6ebd/ADRecon.ps1" -OutFile "#{adrecon_path}"

GUID28093393-6e55-4e23-b67a-d4e6a3426e39

05

Adfind -Listing password policy

windows

cmd

—

1

—

Adfind tool can be used for reconnaissance in an Active directory environment. The example chosen illustrates adfind used to query the local password policy. reference- http://www.joeware.net/freetools/tools/adfind/, https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx

Input arguments

Name	Type	Default	Description
optional_args	string	—	Allows defining arguments to add to the adfind command to tailor it to the specific needs of the environment. Use "-arg" notation to add arguments separated by spaces.

Attack command

"PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" #{optional_args} -default -s base lockoutduration lockoutthreshold lockoutobservationwindow maxpwdage minpwdage minpwdlength pwdhistorylength pwdproperties

Prerequisite

AdFind.exe must exist on disk at specified location (PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe)

Check

if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe") -ErrorAction ignore | Out-Null
Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/bin/AdFind.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe"

GUIDc9f183cf-437d-4748-aa98-8ba053801866

06

Adfind - Enumerate Active Directory Admins

windows

cmd

—

1

—

Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Admin accounts reference- http://www.joeware.net/freetools/tools/adfind/, https://stealthbits.com/blog/fun-with-active-directorys-admincount-attribute/

Input arguments

Name	Type	Default	Description
optional_args	string	—	Allows defining arguments to add to the adfind command to tailor it to the specific needs of the environment. Use "-arg" notation to add arguments separated by spaces.

Attack command

"PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" -sc admincountdmp #{optional_args}

Prerequisite

AdFind.exe must exist on disk at specified location (PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe)

Check

if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe") -ErrorAction ignore | Out-Null
Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/bin/AdFind.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe"

GUID8cd0104c-8ba1-45dd-9f30-421cf1719394

07

Adfind - Enumerate Active Directory User Objects

windows

cmd

—

1

—

Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory User Objects reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html

Input arguments

Name	Type	Default	Description
optional_args	string	—	Allows defining arguments to add to the adfind command to tailor it to the specific needs of the environment. Use "-arg" notation to add arguments separated by spaces.

Attack command

"PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" -f (objectcategory=person) #{optional_args}

Prerequisite

AdFind.exe must exist on disk at specified location (PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe)

Check

if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe") -ErrorAction ignore | Out-Null
Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/bin/AdFind.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe"

GUIDd8d86bff-6c33-4c0e-8dd4-214a7605e7b7

08

Adfind - Enumerate Active Directory Exchange AD Objects

windows

cmd

—

1

—

Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Exchange Objects reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html

Input arguments

Name	Type	Default	Description
optional_args	string	—	Allows defining arguments to add to the adfind command to tailor it to the specific needs of the environment. Use "-arg" notation to add arguments separated by spaces.

Attack command

"PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" -sc exchaddresses #{optional_args}

Prerequisite

AdFind.exe must exist on disk at specified location (PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe)

Check

if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe") -ErrorAction ignore | Out-Null
Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/bin/AdFind.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe"

GUIDa520d475-b5df-4755-8fef-68cc86f69127

09

Enumerate Default Domain Admin Details (Domain)

windows

cmd

—

10

Enumerate Active Directory for Unconstrained Delegation

windows

PowerShell

—

1

—

Attackers may attempt to query for computer objects with the UserAccountControl property 'TRUSTED_FOR_DELEGATION' (0x80000;524288) set More Information - https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html#when-the-stars-align-unconstrained-delegation-leads-to-rce Prerequisite: AD RSAT PowerShell module is needed and it must run under a domain user

Input arguments

Name	Type	Default	Description
domain	string	$env:UserDnsDomain	Domain FQDN
uac_prop	integer	524288	UAC Property to search

Attack command

Get-ADObject -LDAPFilter '(UserAccountControl:1.2.840.113556.1.4.803:=#{uac_prop})' -Server #{domain}

Prerequisite

PowerShell ActiveDirectory Module must be installed

Check

Try {
    Import-Module ActiveDirectory -ErrorAction Stop | Out-Null
    exit 0
}
Catch {
    exit 1
}

Satisfy

if((Get-CimInstance -ClassName Win32_OperatingSystem).ProductType -eq 1) {
  Add-WindowsCapability -Name (Get-WindowsCapability -Name RSAT.ActiveDirectory.DS* -Online).Name -Online
} else {
  Install-WindowsFeature RSAT-AD-PowerShell
}

GUIDc1a444ef-8247-4dc8-97de-544a4eb631f3

11

Get-DomainUser with PowerView

windows

PowerShell

—

12

Enumerate Active Directory Users with ADSISearcher

windows

PowerShell

—

13

Enumerate Linked Policies In ADSISearcher Discovery

windows

PowerShell

—

14

Enumerate Root Domain linked policies Discovery

windows

PowerShell

—

15

WinPwn - generaldomaininfo

windows

PowerShell

—

16

Kerbrute - userenum

windows

PowerShell

—

2

—

Enumerates active directory usernames using the userenum function of Kerbrute

Input arguments

Name	Type	Default	Description
Domain	string	$env:USERDOMAIN	Domain that is being tested against
DomainController	string	$env:UserDnsDomain	Domain Controller that is being tested against

Attack command

cd "PathToAtomicsFolder\..\ExternalPayloads"
.\kerbrute.exe userenum -d #{Domain} --dc #{DomainController} "PathToAtomicsFolder\..\ExternalPayloads\username.txt"

Prerequisite

kerbrute.exe must exist in PathToAtomicsFolder\..\ExternalPayloads.

Check

if (test-path "PathToAtomicsFolder\..\ExternalPayloads\kerbrute.exe"){exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction ignore -Force | Out-Null
invoke-webrequest "https://github.com/ropnop/kerbrute/releases/download/v1.0.3/kerbrute_windows_386.exe" -outfile "PathToAtomicsFolder\..\ExternalPayloads\kerbrute.exe"

Prerequisite

username text file must exist in PathToAtomicsFolder\..\ExternalPayloads.

Check

if (test-path "PathToAtomicsFolder\..\ExternalPayloads\username.txt"){exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction ignore -Force | Out-Null
invoke-webrequest "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1087.002/src/username.txt?raw=true" -outfile "PathToAtomicsFolder\..\ExternalPayloads\username.txt"

GUIDc98fcc87-13aa-47f6-9fd1-a5b16fa7fd44

17

Wevtutil - Discover NTLM Users Remote

windows

PowerShell

—

Yes

18

Suspicious LAPS Attributes Query with Get-ADComputer all properties

windows

PowerShell

—

This test executes LDAP query using powershell command Get-ADComputer and lists all the properties including Microsoft LAPS attributes ms-mcs-AdmPwd and ms-mcs-AdmPwdExpirationTime

Input arguments

Name	Type	Default	Description
hostname	string	$env:computername	Name of the host

Attack command

Get-ADComputer #{hostname} -Properties *

GUID4b062e73-56bc-431b-a1df-bf937940be0d

19

Suspicious LAPS Attributes Query with Get-ADComputer ms-Mcs-AdmPwd property

windows

PowerShell

—

This test executes LDAP query using powershell command Get-ADComputer and lists Microsoft LAPS attributes ms-mcs-AdmPwd and ms-mcs-AdmPwdExpirationTime

Input arguments

Name	Type	Default	Description
hostname	string	$env:computername	Name of the host

Attack command

Get-ADComputer #{hostname} -Properties ms-Mcs-AdmPwd, ms-Mcs-AdmPwdExpirationTime

GUIDaec2e350-9b59-4ea0-9cda-e4e0836a0ee2

20

Suspicious LAPS Attributes Query with Get-ADComputer all properties and SearchScope

windows

PowerShell

—

21

Suspicious LAPS Attributes Query with adfind all properties

windows

PowerShell

—

This test executes LDAP query using adfind command and lists all the attributes including Microsoft LAPS attributes ms-mcs-AdmPwd and ms-mcs-AdmPwdExpirationTime

Input arguments

Name	Type	Default	Description
domain	string	$env:USERDOMAIN	Domain of the host
optional_args	string	—	Allows defining arguments to add to the adfind command to tailor it to the specific needs of the environment. Use "-arg" notation to add arguments separated by spaces.

Attack command

& "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" #{optional_args} -h #{domain} -s subtree -f "objectclass=computer" *

GUIDaa522482-006d-4d64-abaf-13b79ae9fa38

22

Suspicious LAPS Attributes Query with adfind ms-Mcs-AdmPwd

windows

PowerShell

—

This test executes LDAP query using adfind command and lists Microsoft LAPS attributes ms-mcs-AdmPwd and ms-mcs-AdmPwdExpirationTime

Input arguments

Name	Type	Default	Description
domain	string	$env:USERDOMAIN	Domain of the host
optional_args	string	—	Allows defining arguments to add to the adfind command to tailor it to the specific needs of the environment. Use "-arg" notation to add arguments separated by spaces.

Attack command

& "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" #{optional_args} -h #{domain} -s subtree -f "objectclass=computer" ms-Mcs-AdmPwd, ms-Mcs-AdmPwdExpirationTime

GUID585d9cc7-ce4e-41ea-8d93-daca10f3dc69

23

Active Directory Domain Search

linux

sh

—

1

—

Output information from LDAPSearch. LDAP Password is the admin-user password on Active Directory

Input arguments

Name	Type	Default	Description
user	string	user@example.test	username@domain of a user within the ad database
domain	string	example	The domain to be tested
password	string	s3CurePssw0rD!	password of the user with admin privileges referenced in admin_user
top_level_domain	string	test	The top level domain (.com, .test, .remote, etc... following domain, minus the .)

Attack command

ldapsearch -H ldap://#{domain}.#{top_level_domain}:389 -x -D #{user} -w #{password} -b "CN=Users,DC=#{domain},DC=#{top_level_domain}" -s sub -a always -z 1000 dn

Prerequisite

Packages sssd-ad sssd-tools realmd adcli installed and realm available, ldapsearch

Check

which ldapsearch

Satisfy

echo ldapsearch not found

GUIDab65a320-5e44-4896-9fc3-2c9a890c9644

24

Account Enumeration with LDAPDomainDump

linux

sh

—

4

Yes

This test uses LDAPDomainDump to perform account enumeration on a domain. Reference

Input arguments

Name	Type	Default	Description
password	string	password	Password to authenticate with
username	string	domain\user	Username and domain to authenticate with
target_ip	string	127.0.0.1	IP to connect to

Attack command

ldapdomaindump -u #{username} -p #{password} #{target_ip} -o /tmp/T1087

Cleanup command

rm -rf /tmp/T1087/ 2>/dev/null

Prerequisite

Python3 must be installed

Check

if [ -x "$(command -v python3 --version)" ]; then exit 0; else exit 1; fi;

Satisfy

sudo apt-get -y install python3

Prerequisite

Pip must be installed

Check

if [ -x "$(command -v pip --version)" ]; then exit 0; else exit 1; fi;

Satisfy

wget -O /tmp/get-pip.py https://bootstrap.pypa.io/pip/3.6/get-pip.py
python3 /tmp/get-pip.py

Prerequisite

The ldapdomaindump module must be installed

Check

python3 -c 'import ldapdomaindump' 2>/dev/null

Satisfy

pip install ldapdomaindump

Prerequisite

The future module must be installed

Check

python3 -c 'import future' 2>/dev/null

Satisfy

pip install future

GUID4a610da2-fefa-4df6-a559-7b2f59754859

Tests from Atomic Red Team (MIT licence) · technique definition

Domain Account detections T1087.002

51 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 4%of all ATT&CK techniques for number of rules

Product

Severity

Library

tf

Loading...

Drag headers to reorder | Drag edges to resize

tf

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs

Domain Account T1087.002

Domain Account MITRE reference T1087.002

Offense vs defense T1087.002

How it got here

Domain Account Enumeration Across Platforms

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

D3FEND techniques

Data model references

Implementations

Unit tests

D3FEND techniques

Data model references

Implementations