CmdID / Techniques / T1087

T1087.002 Account Discovery: Domain Account

Adversaries may attempt to get a listing of domain accounts. MITRE ATT&CK

12 Sigma rules T1087.002 on attack.mitre.org

Part of

MITRE ATT&CK

T1087Account Discovery

Sigma rules tagged with it

process creation, the highest levels first

highHackTool - Bloodhound/Sharphound ExecutionFlorian Roth (Nextron Systems) · Windows

highMalicious PowerShell Commandlets - ProcessCreationNasreddine Bencherchali (Nextron Systems) · Windows

highPUA - AdFind Suspicious ExecutionJanantha Marasinghe (https://github.com/blueteam0ps), FPT.EagleEye Team, omkar72, oscd.community · Windows

highPUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXEfrack113 · Windows

highRenamed AdFind ExecutionFlorian Roth (Nextron Systems) · Windows

highSuspicious Active Directory Database Snapshot Via ADExplorerNasreddine Bencherchali (Nextron Systems) · Windows

mediumActive Directory Database Snapshot Via ADExplorerNasreddine Bencherchali (Nextron Systems) · Windows

mediumActive Directory Structure Export Via Csvde.EXENasreddine Bencherchali (Nextron Systems) · Windows

mediumPUA - AdFind.EXE ExecutionSwachchhanda Shrawan Poudel (Nextron Systems) · Windows

mediumSuspicious Group And Account Reconnaissance Activity Using Net.EXEFlorian Roth (Nextron Systems), omkar72, @svch0st, Nasreddine Bencherchali (Nextron Systems) · Windows

mediumSuspicious Use of PsLogListNasreddine Bencherchali (Nextron Systems) · Windows

lowNet.EXE ExecutionMichael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements) · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Start or stop a Windows service synchronously on the page for net

net start serviceIdentify

Show the folders currently shared over SMB on the page for net

net shareIdentify

Show users in a local security group on the page for net

net localgroup "Administrators"Identify

To display a list of all user accounts for the local computer, run the following command on the page for net user

net userIdentify

To display information about the user account TommyH, run the following command on the page for net user

net user tommyhIdentify

To set the sign-in time from 8 AM to 5 PM for the username MikeD using 24-hour notation, run the following command on the page for net user

net user miked /time:M-F,08:00-17:00Identify

To set the sign-in time from 8 AM to 5 PM for MikeD using 12-hour notation, run the following command on the page for net user

net user miked /time:M-F,8AM-5PMIdentify

To specify sign-in hours of 4 AM to 12 PM on Monday, 12 PM to 8 PM on Tuesday, and 8 AM to 5 PM Wednesday through Friday for username AnibalS, run the following command on the page for net user

net user anibals /time:M,4AM-12PM;T,12PM-8PM;W-F,8AM-5PMIdentify

Suspend a workflow job by name on the page for Suspend-Job

#Sample Workflow
workflow Get-SystemLog
{
$Events = Get-WinEvent -LogName System
CheckPoint-Workflow
inlinescript {\\Server01\Scripts\Analyze-SystemEvents.ps1 -Events $Events}
}
Get-SystemLog -AsJob -JobName "LogflowJob"
Get-Job -Name LogflowJob

Identify

An example is here when CmdID’s reading of it names T1087.002: a Sigma rule it trips is tagged with it, or its abuse is documented as it.