Account Discovery: Domain Account

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior.

Commands such as net user /domain and net group /domain of the Net utility, dscacheutil -q groupon macOS, and ldapsearch on Linux can list domain users and groups.

ID: T1087.002
Sub-technique of:  T1087
Tactic: Discovery
Platforms: Linux, Windows, macOS
Permissions Required: User
Data Sources: API monitoring, Process command-line parameters, Process monitoring
Version: 1.0
Created: 21 February 2020
Last Modified: 26 March 2020

Procedure Examples

Name Description

Bankshot gathers domain and account names/information through process monitoring.[8]


BRONZE BUTLER has used net user /domain to identify account information.[14]

Dragonfly 2.0

Dragonfly 2.0 used batch scripts to enumerate users on a victim domain controller.[16]


dsquery can be used to gather information on user accounts within a domain.[2]


Empire can acquire local and domain user account information.[3]


FIN6 has used Metasploit’s PsExec NTDSGRAB module to obtain a copy of the victim's Active Directory database.[11]


Ke3chang performs account discovery using commands such as net localgroup administrators and net group "REDACTED" /domain on specific permissions groups.[12]


menuPass has used the Microsoft administration tool csvde.exe to export Active Directory data.[13]


Net commands used with the /domain flag can be used to gather information about and manipulate user accounts on the current domain.[5]


OilRig has run net user, net user /domain, net group "domain admins" /domain, and net group "Exchange Trusted Subsystem" /domain to get account listings on a victim.[15]


OSInfo enumerates local and domain users[7]

Poseidon Group

Poseidon Group searches for administrator accounts on both the local victim machine and the network.[17]


PoshC2 can enumerate local and domain user account information.[4]


POWRUNER may collect user account information by running net user /domain or a series of other commands on a victim.[6]

Sandworm Team

Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about usernames listed in AD.[18]


Sykipot may use net group "domain admins" /domain to display accounts in the "domain admins" permissions group and net localgroup "administrators" to list local system administrator group membership.[9]


Turla has used net user /domain to enumerate domain accounts.[19]


Valak has the ability to enumerate domain admin accounts.[10]


Mitigation Description
Operating System Configuration

Prevent administrator accounts from being enumerated when an application is elevating through UAC since it can lead to the disclosure of account names. The Registry key is located at HKLM\ SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\EnumerateAdministrators. It can be disabled through GPO: Computer Configuration > [Policies] > Administrative Templates > Windows Components > Credential User Interface: Enumerate administrator accounts on elevation.[1]


System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.