MITRE ATT&CKsub-technique
T1087.002 Domain Account
- Domain
- enterprise
- Tactics
- Discovery
- Platforms
- Linux, macOS, Windows
- Version
- 1.2
- Created
- 2020-02-21
Description
Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.
Commands such as net user /domain and net group /domain of the Net utility, dscacheutil -q group on macOS, and ldapsearch on Linux can list domain users and groups. PowerShell cmdlets including Get-ADUser and Get-ADGroupMember may enumerate members of Active Directory groups.
Related
Subtechnique of · MITRE ATT&CK (1)
- T1087 Account Discovery technique
Tactic · MITRE ATT&CK (1)
- TA0007 Discovery tactic
Referenced by MITRE ATT&CK · mitigates (1)
- M1028 Operating System Configuration mitigation
Referenced by MITRE ATT&CK · uses (62)
- G1059 NIMBUS MANTICORE group
- S9035 LAMEHUG software (malware)
- S9037 RustyWater software (malware)
- G1055 VOID MANTICORE group
- G1054 MirrorFace group
- G1053 Storm-0501 group
- S1242 Qilin software (malware)
- G1046 Storm-1811 group
- G1043 BlackByte group
- G1039 RedCurl group
- S1159 DUSTTRAP software (malware)
- S1160 Latrodectus software (malware)
- S1146 MgBot software (malware)
- G1032 INC Ransom group
- G1022 ToddyCat group
- G1016 FIN13 group
- G1017 Volt Typhoon group
- G1015 Scattered Spider group
- C0024 SolarWinds Compromise campaign
- C0022 Operation Dream Job campaign
- S1068 BlackCat software (malware)
- S1063 Brute Ratel C4 software (tool)
- C0014 Operation Wocao campaign
- C0012 Operation CuckooBees campaign
- S1022 IceApple software (malware)
- G1004 LAPSUS$ group
- S0692 SILENTTRINITY software (tool)
- S0635 BoomBox software (malware)
- G0129 Mustang Panda group
- S0552 AdFind software (tool)
References
- https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/ CrowdStrike StellarParticle January 2022