Description
Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.
Commands such as net user /domain and net group /domain of the Net utility, dscacheutil -q group on macOS, and ldapsearch on Linux can list domain users and groups. PowerShell cmdlets including Get-ADUser and Get-ADGroupMember may enumerate members of Active Directory groups.(Citation: CrowdStrike StellarParticle January 2022)
Platforms
Mitigations (1)
Operating System ConfigurationM1028
Prevent administrator accounts from being enumerated when an application is elevating through UAC since it can lead to the disclosure of account names. The Registry key is located at HKLM\ SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\EnumerateAdministrators. It can be disabled through GPO: Computer Configuration > [Policies] > Administrative Templates > Windows Components
Threat Groups (29)
| ID | Group | Context |
|---|---|---|
| G1043 | BlackByte | [BlackByte](https://attack.mitre.org/groups/G1043) has used tools such as [AdFind](https://attack.mitre.org/software/S0552) to identify and enumerate ... |
| G1017 | Volt Typhoon | [Volt Typhoon](https://attack.mitre.org/groups/G1017) has run `net group /dom` and `net group "Domain Admins" /dom` in compromised environments for ac... |
| G0096 | APT41 | [APT41](https://attack.mitre.org/groups/G0096) used built-in <code>net</code> commands to enumerate domain administrator users.(Citation: Rostovcev AP... |
| G0035 | Dragonfly | [Dragonfly](https://attack.mitre.org/groups/G0035) has used batch scripts to enumerate users on a victim domain controller.(Citation: US-CERT TA18-074... |
| G0045 | menuPass | [menuPass](https://attack.mitre.org/groups/G0045) has used the Microsoft administration tool csvde.exe to export Active Directory data.(Citation: PWC ... |
| G0069 | MuddyWater | [MuddyWater](https://attack.mitre.org/groups/G0069) has used <code>cmd.exe net user /domain</code> to enumerate domain users.(Citation: Trend Micro Mu... |
| G0037 | FIN6 | [FIN6](https://attack.mitre.org/groups/G0037) has used Metasploit’s [PsExec](https://attack.mitre.org/software/S0029) NTDSGRAB module to obtain a copy... |
| G1046 | Storm-1811 | [Storm-1811](https://attack.mitre.org/groups/G1046) has performed domain account enumeration during intrusions.(Citation: Microsoft Storm-1811 2024) |
| G0046 | FIN7 | [FIN7](https://attack.mitre.org/groups/G0046) has used the PowerShell script 3CF9.ps1 and the executable WsTaskLoad to enumerate domain administration... |
| G0034 | Sandworm Team | [Sandworm Team](https://attack.mitre.org/groups/G0034) has used a tool to query Active Directory using LDAP, discovering information about usernames l... |
| G0129 | Mustang Panda | [Mustang Panda](https://attack.mitre.org/groups/G0129) has utilized [AdFind](https://attack.mitre.org/software/S0552) to identify domain users.(Citati... |
| G1015 | Scattered Spider | [Scattered Spider](https://attack.mitre.org/groups/G1015) has enumerated legitimate domain accounts which are used in the targeted environment.(Citati... |
| G0049 | OilRig | [OilRig](https://attack.mitre.org/groups/G0049) has run <code>net user</code>, <code>net user /domain</code>, <code>net group “domain admins” /domain<... |
| G0004 | Ke3chang | [Ke3chang](https://attack.mitre.org/groups/G0004) performs account discovery using commands such as <code>net localgroup administrators</code> and <co... |
| G0010 | Turla | [Turla](https://attack.mitre.org/groups/G0010) has used <code>net user /domain</code> to enumerate domain accounts.(Citation: ESET ComRAT May 2020) |
| G1053 | Storm-0501 | [Storm-0501](https://attack.mitre.org/groups/G1053) has utilized an obfuscated version of the Active Directory reconnaissance tool ADRecon.ps1 (obfs.p... |
| G0033 | Poseidon Group | [Poseidon Group](https://attack.mitre.org/groups/G0033) searches for administrator accounts on both the local victim machine and the network.(Citation... |
| G1039 | RedCurl | [RedCurl](https://attack.mitre.org/groups/G1039) has collected information about domain accounts using SysInternal’s AdExplorer functionality .(Cita... |
| G0030 | Lotus Blossom | [Lotus Blossom](https://attack.mitre.org/groups/G0030) has used `net` commands and tools such as [AdFind](https://attack.mitre.org/software/S0552) to ... |
| G0114 | Chimera | [Chimera](https://attack.mitre.org/groups/G0114) has has used <code>net user /dom</code> and <code>net user Administrator</code> to enumerate domain a... |
Associated Software (28)
| ID | Name | Type | Context |
|---|---|---|---|
| S0603 | Stuxnet | Malware | [Stuxnet](https://attack.mitre.org/software/S0603) enumerates user accounts of the domain.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien Febru... |
| S0184 | POWRUNER | Malware | [POWRUNER](https://attack.mitre.org/software/S0184) may collect user account information by running <code>net user /domain</code> or a series of other... |
| S0239 | Bankshot | Malware | [Bankshot](https://attack.mitre.org/software/S0239) gathers domain and account names/information through process monitoring.(Citation: McAfee Bankshot... |
| S1159 | DUSTTRAP | Malware | [DUSTTRAP](https://attack.mitre.org/software/S1159) can enumerate domain accounts.(Citation: Google Cloud APT41 2024) |
| S9037 | RustyWater | Malware | [RustyWater](https://attack.mitre.org/software/S9037) has gathered the domain membership of the victim machine’s user.(Citation: CloudSEK_RustyWater_J... |
| S1068 | BlackCat | Malware | [BlackCat](https://attack.mitre.org/software/S1068) can utilize `net use` commands to identify domain users.(Citation: Microsoft BlackCat Jun 2022) |
| S0483 | IcedID | Malware | [IcedID](https://attack.mitre.org/software/S0483) can query LDAP and can use built-in `net` commands to identify additional users on the network to in... |
| S0018 | Sykipot | Malware | [Sykipot](https://attack.mitre.org/software/S0018) may use <code>net group "domain admins" /domain</code> to display accounts in the "domain admins" p... |
| S1160 | Latrodectus | Malware | [Latrodectus](https://attack.mitre.org/software/S1160) can run `C:\Windows\System32\cmd.exe /c net group "Domain Admins" /domain` to identify domain a... |
| S0534 | Bazar | Malware | [Bazar](https://attack.mitre.org/software/S0534) has the ability to identify domain administrator accounts.(Citation: NCC Group Team9 June 2020)(Citat... |
| S1146 | MgBot | Malware | [MgBot](https://attack.mitre.org/software/S1146) includes modules for collecting information on Active Directory domain accounts.(Citation: Symantec D... |
| S0154 | Cobalt Strike | Malware | [Cobalt Strike](https://attack.mitre.org/software/S0154) can determine if the user on an infected machine is in the admin or domain admin group.(Citat... |
| S0476 | Valak | Malware | [Valak](https://attack.mitre.org/software/S0476) has the ability to enumerate domain admin accounts.(Citation: Cybereason Valak May 2020) |
| S0635 | BoomBox | Malware | [BoomBox](https://attack.mitre.org/software/S0635) has the ability to execute an LDAP query to enumerate the distinguished name, SAM account name, and... |
| S9035 | LAMEHUG | Malware | [LAMEHUG](https://attack.mitre.org/software/S9035) can use [dsquery](https://attack.mitre.org/software/S0105) to enumerate domain user information.(Ci... |
| S1022 | IceApple | Malware | The [IceApple](https://attack.mitre.org/software/S1022) Active Directory Querier module can perform authenticated requests against an Active Director... |
| S1242 | Qilin | Malware | [Qilin](https://attack.mitre.org/software/S1242) can use PowerShell cmdlets to enumerate domain users.(Citation: Cisco Talos Qilin Ransomware OCT 2025... |
| S0516 | SoreFang | Malware | [SoreFang](https://attack.mitre.org/software/S0516) can enumerate domain accounts via <code>net.exe user /domain</code>.(Citation: CISA SoreFang July ... |
| S0165 | OSInfo | Malware | [OSInfo](https://attack.mitre.org/software/S0165) enumerates local and domain users(Citation: Symantec Buckeye) |
| S0039 | Net | Tool | [Net](https://attack.mitre.org/software/S0039) commands used with the <code>/domain</code> flag can be used to gather information about and manipulate... |
References
Frequently Asked Questions
What is T1087.002 (Domain Account)?
T1087.002 is a MITRE ATT&CK technique named 'Domain Account'. It belongs to the Discovery tactic(s). Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific account...
How can T1087.002 be detected?
Detection of T1087.002 (Domain Account) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1087.002?
There are 1 documented mitigations for T1087.002. Key mitigations include: Operating System Configuration.
Which threat groups use T1087.002?
Known threat groups using T1087.002 include: BlackByte, Volt Typhoon, APT41, Dragonfly, menuPass, MuddyWater, FIN6, Storm-1811.