Account Discovery

Jump to: navigation, search
Account Discovery
ID T1087
Tactic Discovery
Platform Windows Server 2003, Windows Server 2008, Windows Server 2012, Windows XP, Windows 7, Windows 8, Windows Server 2003 R2, Windows Server 2008 R2, Windows Server 2012 R2, Windows Vista, Windows 8.1
Permissions Required User
Data Sources API monitoring, Process command-line parameters, Process monitoring

Adversaries may attempt to get a listing of local system or domain accounts. Example commands that can acquire this information are net user, net group <groupname>, and net localgroup <groupname> using the Net utility or through use of dsquery. If adversaries attempt to identify the primary user, currently logged in user, or set of users that commonly uses a system, System Owner/User Discovery may apply.


  • Ke3chang performs account discovery using commands such as net localgroup administrators and net group "REDACTED" /domain on specific permissions groups.1
  • admin@338 actors used the following commands following exploitation of a machine with LOWBALL malware to enumerate user accounts: ** net user >> %temp%\download ** net user /domain >> %temp%\download2
  • APT3 has used a tool that can obtain info about local and global group users, power users, and administrators.3
  • Poseidon Group searches for administrator accounts on both the local victim machine and the network.4
  • FIN6 has used Metasploit’s PsExec NTDSGRAB module to obtain a copy of the victim's Active Directory database.5
  • Sykipot may use net group "domain admins" /domain to display accounts in the "domain admins" permissions group and net localgroup "administrators" to list local system administrator group membership.6
  • The discovery modules used with Duqu can collect information on accounts and permissions.7
  • Commands under net user can be used in Net to gather information about and manipulate user accounts.8
  • GeminiDuke collects information on local user accounts from the victim.9
  • SHOTPUT has a command to retrieve information about connected users.10
  • Elise executes net user after initial communication is made to the remote server.11
  • Mis-Type may create a file containing the results of the command cmd.exe /c net user {Username}.12
  • S-Type runs the command net user on a victim. S-Type also runs tests to determine the privilege level of the compromised user.12
  • dsquery can be used to gather information on user accounts within a domain.13
  • Remsec can obtain a list of users.14


Identify unnecessary system utilities or potentially malicious software that may be used to acquire information about system and domain accounts, and audit and/or block them by using whitelisting15 tools, like AppLocker,1617 or Software Restriction Policies18 where appropriate.19


System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.

Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.