T1087.002 Domain Account

discovery — Linux, macOS, Windows · attack.mitre.org · JSON

MITRE detection strategy

analytics

Sigma rules tagged attack.t1087.002

KEV CVEs mapped here

<p>Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.</p><p>Commands such as <code>net user /domain</code> and <code>net group /domain</code> of the Net utility, <code>dscacheutil -q group</code> on macOS, and <code>ldapsearch</code> on Linux can list domain users and groups. PowerShell cmdlets including <code>Get-ADUser</code> and <code>Get-ADGroupMember</code> may enumerate members of Active Directory groups.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

CVE	Vendor / product	Mapping type	State	Added
CVE-2023-32315	Ignite Realtime Openfire	secondary impact	Mapped	2023-08-24
CVE-2023-3519	Citrix NetScaler ADC and NetScaler Gateway	secondary impact	Mapped	2023-07-19
CVE-2021-44077	Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus	secondary impact	Mapped	2021-12-01
CVE-2020-1472	Microsoft Netlogon	primary impact secondary impact	Mapped	2021-11-03
CVE-2021-40539	Zoho ManageEngine	secondary impact	Mapped	2021-11-03

Detection strategy · ATT&CK Enterprise v19.2

DET0129 Domain Account Enumeration Across Platforms v1.0
AN0363 Windows
Adversary enumeration of domain accounts using net.exe, PowerShell, WMI, or LDAP queries from non-domain controllers or non-admin endpoints.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106 → DC0064 Command Execution
NSM:Flow LDAP Bind/Search → DC0085 Network Traffic Content

Tunable: CommandLinePattern TimeWindow SourceHost

AN0364 Linux
Domain account enumeration using ldapsearch, samba tools (e.g., 'wbinfo -u'), or winbindd lookups.

auditd:SYSCALL execve → DC0032 Process Creation
linuxsyslog nslcd or winbind logs → DC0064 Command Execution
NSM:Flow LDAP Query → DC0085 Network Traffic Content

Tunable: ProcessName LDAPSearchFilter UserContext

AN0365 macOS
Domain group and user enumeration via dscl or dscacheutil, or queries to directory services from non-admin endpoints.

macos:unifiedlog Process Execution → DC0032 Process Creation
macos:unifiedlog DS daemon log entries → DC0064 Command Execution

Tunable: CommandPattern EndpointRole

Sigma rules · SigmaHQ da9bb07d64, tag `attack.t1087.002`

Malicious PowerShell Commandlets - ProcessCreation hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-02 (modified 2025-12-10) · logsource: product=windows category=process_creation · 02030f2f-6199-49ec-b258-ea71b07e03dc

Detects Commandlet names from well-known PowerShell exploitation frameworks

BloodHound Collection Files hightest

Author: C.J. May · 2022-08-09 (modified 2026-02-19) · logsource: product=windows category=file_event · 02773bed-83bf-469f-b7ff-e676e7d78bab

Detects default file names outputted by the BloodHound collection tool SharpHound

Techniques: T1087.001 T1087.002 T1482 T1069.001 T1069.002 T1059.001

ADExplorer Writing Complete AD Snapshot Into .dat File mediumexperimental

Author: Arnim Rupp (Nextron Systems), Thomas Patzke · 2025-07-09 · logsource: product=windows category=file_event · 0a1255c5-d732-4b62-ac02-b5152d34fb83

Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.

Techniques: T1087.002 T1069.002 T1482

Net.EXE Execution lowtest

Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements) · 2019-01-16 (modified 2022-07-11) · logsource: product=windows category=process_creation · 183e7ea8-ac4b-4c23-9aec-b3dac4e401ac

Detects execution of "Net.EXE".

Techniques: T1007 T1049 T1018 T1135 T1201 T1069.001 T1069.002 T1087.001 T1087.002 T1021.002

Potential Active Directory Reconnaissance/Enumeration Via LDAP mediumtest

Author: Adeem Mawani · 2021-06-22 (modified 2025-07-04) · logsource: product=windows service=ldap · 31d68132-4038-47c7-8f8e-635a39a7c174

Detects potential Active Directory enumeration via LDAP

Techniques: T1069.002 T1087.002 T1482

AD Privileged Users or Groups Reconnaissance hightest

Author: Samir Bousseaden · 2019-04-03 (modified 2022-07-13) · logsource: product=windows service=security · 35ba1d85-724d-42a3-889f-2e2362bcaf23

Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs

Techniques: T1087.002

Active Directory Computers Enumeration With Get-AdComputer lowtest

Author: frack113 · 2022-03-17 (modified 2023-07-08) · logsource: product=windows category=ps_script · 36bed6b2-e9a0-4fff-beeb-413a92b86138

Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.

Techniques: T1018 T1087.002

PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE hightest

Author: frack113 · 2021-12-13 (modified 2023-03-05) · logsource: product=windows category=process_creation · 455b9d50-15a1-4b99-853f-8d37655a4c1b

Detects active directory enumeration activity using known AdFind CLI flags

Techniques: T1087.002

PUA - AdFind.EXE Execution mediumexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-02-26 · logsource: product=windows category=process_creation · 514e7e3e-b3b4-4a67-af60-be20f139198b

Detects execution of Adfind.exe utility, which can be used for reconnaissance in an Active Directory environment

Techniques: T1087.002

Malicious PowerShell Commandlets - PoshModule hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-20 (modified 2025-12-10) · logsource: product=windows category=ps_module · 7d0d0329-0ef1-4e84-a9f5-49500f9d7c6c

Detects Commandlet names from well-known PowerShell exploitation frameworks

Techniques: T1482 T1087 T1087.001 T1087.002 T1069.001 T1069.002 T1069 T1059.001

Malicious PowerShell Commandlets - ScriptBlock hightest

Author: Sean Metcalf, Florian Roth, Bartlomiej Czyz @bczyz1, oscd.community, Nasreddine Bencherchali, Tim Shelton, Mustafa Kaan Demir, Georg Lauenstein, Max Altgelt, Tobias Michalski, Austin Songer · 2017-03-05 (modified 2025-12-10) · logsource: product=windows category=ps_script · 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6

Detects Commandlet names from well-known PowerShell exploitation frameworks

Techniques: T1482 T1087 T1087.001 T1087.002 T1069.001 T1069.002 T1069 T1059.001

Active Directory Database Snapshot Via ADExplorer mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-03-14 (modified 2025-07-09) · logsource: product=windows category=process_creation · 9212f354-7775-4e28-9c9f-8f0a4544e664

Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.

Techniques: T1087.002 T1069.002 T1482

Reconnaissance Activity hightest

Author: Florian Roth (Nextron Systems), Jack Croock (method), Jonhnathan Ribeiro (improvements), oscd.community · 2017-03-07 (modified 2022-08-22) · logsource: product=windows service=security · 968eef52-9cff-4454-8992-1e74b9cbad6c

Detects activity as "net user administrator /domain" and "net group domain admins /domain"

Techniques: T1087.002 T1069.002

PUA - AdFind Suspicious Execution hightest

Author: Janantha Marasinghe (https://github.com/blueteam0ps), FPT.EagleEye Team, omkar72, oscd.community · 2021-02-02 (modified 2025-10-24) · logsource: product=windows category=process_creation · 9a132afa-654e-11eb-ae93-0242ac130002

Detects AdFind execution with common flags seen used during attacks

Techniques: T1018 T1087.002 T1482 T1069.002

Suspicious Use of PsLogList mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2021-12-18 (modified 2026-06-29) · logsource: product=windows category=process_creation · aae1243f-d8af-40d8-ab20-33fc6d0c55bc

Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery or delete events logs

Techniques: T1087 T1087.001 T1087.002

Potential AD User Enumeration From Non-Machine Account mediumtest

Author: Maxime Thiebaut (@0xThiebaut) · 2020-03-30 (modified 2022-11-08) · logsource: product=windows service=security · ab6bffca-beff-4baa-af11-6733f296d57a

Detects read access to a domain user from a non-machine account

Techniques: T1087.002

Suspicious Group And Account Reconnaissance Activity Using Net.EXE mediumtest

Author: Florian Roth (Nextron Systems), omkar72, @svch0st, Nasreddine Bencherchali (Nextron Systems) · 2019-01-16 (modified 2023-03-02) · logsource: product=windows category=process_creation · d95de845-b83c-4a9a-8a6a-4fc802ebf6c0

Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE Check if the user that executed the commands is suspicious (e.g. service accounts, LOCAL_SYSTEM)

Techniques: T1087.001 T1087.002

Renamed AdFind Execution hightest

Author: Florian Roth (Nextron Systems) · 2022-08-21 (modified 2025-02-26) · logsource: product=windows category=process_creation · df55196f-f105-44d3-a675-e9dfb6cc2f2b

Detects the use of a renamed Adfind.exe. AdFind continues to be seen across majority of breaches. It is used to domain trust discovery to plan out subsequent steps in the attack chain.

Techniques: T1018 T1087.002 T1482 T1069.002

Active Directory Structure Export Via Csvde.EXE mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-03-14 · logsource: product=windows category=process_creation · e5d36acd-acb4-4c6f-a13f-9eb203d50099

Detects the execution of "csvde.exe" in order to export organizational Active Directory structure.

Techniques: T1087.002

Suspicious Active Directory Database Snapshot Via ADExplorer hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-03-14 (modified 2025-07-09) · logsource: product=windows category=process_creation · ef61af62-bc74-4f58-b49b-626448227652

Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database to a suspicious directory. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.

Techniques: T1087.002 T1069.002 T1482

HackTool - Bloodhound/Sharphound Execution hightest

Author: Florian Roth (Nextron Systems) · 2019-12-20 (modified 2023-02-04) · logsource: product=windows category=process_creation · f376c8a7-a2d0-4ddc-aa0c-16c17236d962

Detects command line parameters used by Bloodhound and Sharphound hack tools

Techniques: T1087.001 T1087.002 T1482 T1069.001 T1069.002 T1059.001

Rules tagged at the parent level (attack.t1087) 16

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

Malicious PowerShell Commandlets - ProcessCreation hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-02 (modified 2025-12-10) · logsource: product=windows category=process_creation · 02030f2f-6199-49ec-b258-ea71b07e03dc

Detects Commandlet names from well-known PowerShell exploitation frameworks

Techniques: T1482 T1087 T1087.001 T1087.002 T1069.001 T1069.002 T1069 T1059.001

Hacktool Ruler hightest

Author: Florian Roth (Nextron Systems) · 2017-05-31 (modified 2022-10-09) · logsource: product=windows service=security · 24549159-ac1b-479c-8175-d42aea947cae

This events that are generated when using the hacktool Ruler by Sensepost

Techniques: T1087 T1114 T1059 T1550.002

PUA - Seatbelt Execution hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-10-18 (modified 2023-02-04) · logsource: product=windows category=process_creation · 38646daa-e78f-4ace-9de0-55547b2d30da

Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters

Techniques: T1526 T1087 T1083

Webshell Hacking Activity Patterns hightest

Author: Florian Roth (Nextron Systems) · 2022-03-17 (modified 2023-11-09) · logsource: product=windows category=process_creation · 4ebc877f-4612-45cb-b3a5-8e3834db36c9

Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system

Techniques: T1505.003 T1018 T1033 T1087

SharpHound Recon Account Discovery hightest

Author: Sagie Dulce, Dekel Paz · 2022-01-01 · logsource: product=rpc_firewall category=application · 65f77b1e-8e79-45bf-bb67-5988a8ce45a5

Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.

Techniques: T1087

Potential Pikabot Discovery Activity hightest

Author: Andreas Braathen (mnemonic.io) · 2023-10-27 (modified 2024-01-26) · logsource: product=windows category=process_creation · 698d4431-514f-4c82-af4d-cf573872a9f5

Detects system discovery activity carried out by Pikabot, such as incl. network, user info and domain groups. The malware Pikabot has been seen to use this technique as part of its C2-botnet registration with a short collection time frame (less than 1 minute).

Techniques: T1016 T1049 T1087

Malicious PowerShell Commandlets - PoshModule hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-20 (modified 2025-12-10) · logsource: product=windows category=ps_module · 7d0d0329-0ef1-4e84-a9f5-49500f9d7c6c

Detects Commandlet names from well-known PowerShell exploitation frameworks

Techniques: T1482 T1087 T1087.001 T1087.002 T1069.001 T1069.002 T1069 T1059.001

Malicious PowerShell Commandlets - ScriptBlock hightest

Detects Commandlet names from well-known PowerShell exploitation frameworks

Techniques: T1482 T1087 T1087.001 T1087.002 T1069.001 T1069.002 T1069 T1059.001

HackTool - winPEAS Execution hightest

Author: Georg Lauenstein (sure[secure]) · 2022-09-19 (modified 2023-03-23) · logsource: product=windows category=process_creation · 98b53e78-ebaf-46f8-be06-421aafd176d9

WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz

Techniques: T1082 T1087 T1046

Suspicious Use of PsLogList mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2021-12-18 (modified 2026-06-29) · logsource: product=windows category=process_creation · aae1243f-d8af-40d8-ab20-33fc6d0c55bc

Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery or delete events logs

Techniques: T1087 T1087.001 T1087.002

Uncommon Connection to Active Directory Web Services mediumtest

Author: @kostastsale · 2024-01-26 · logsource: product=windows category=network_connection · b3ad3c0f-c949-47a1-a30e-b0491ccae876

Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated with ADWS management.

Techniques: T1087

Potentially Suspicious EventLog Recon Activity Using Log Query Utilities mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) · 2022-09-09 (modified 2025-12-02) · logsource: product=windows category=process_creation · beaa66d6-aa1b-4e3c-80f5-e0145369bfaf

Detects execution of different log query utilities and commands to search and dump the content of specific event logs or look for specific event IDs. This technique is used by threat actors in order to extract sensitive information from events logs such as usernames, IP addresses, hostnames, etc.

Techniques: T1552 T1087

Webshell Detection With Command Line Keywords hightest

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson · 2017-01-01 (modified 2026-07-14) · logsource: product=windows category=process_creation · bed2a484-9348-4143-8a8a-b801c979301c

Detects certain command line parameters often used during reconnaissance activity via web shells

Techniques: T1505.003 T1018 T1033 T1087

Network Reconnaissance Activity hightest

Author: Florian Roth (Nextron Systems) · 2022-02-07 · logsource: product=windows category=process_creation · e6313acd-208c-44fc-a0ff-db85d572e90e

Detects a set of suspicious network related commands often used in recon stages

Techniques: T1087 T1082

HackTool - SOAPHound Execution hightest

Author: @kostastsale · 2024-01-26 · logsource: product=windows category=process_creation · e92a4287-e072-4a40-9739-370c106bb750

Detects the execution of SOAPHound, a .NET tool for collecting Active Directory data, using specific command-line arguments that may indicate an attempt to extract sensitive AD information.

Techniques: T1087

Chopper Webshell Process Pattern hightest

Author: Florian Roth (Nextron Systems), MSTI (query) · 2022-10-01 · logsource: product=windows category=process_creation · fa3c117a-bc0d-416e-a31b-0c0e80653efb

Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells

Techniques: T1505.003 T1018 T1033 T1087

T1087.002 Domain Account

KEV CVEs mapped to this technique · CTID Mappings Explorer

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1087.002

Rules tagged at the parent level (attack.t1087) 16

Sigma rules · SigmaHQ da9bb07d64, tag `attack.t1087.002`