T1087 Account Discovery

Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. MITRE ATT&CK

11 Sigma rules T1087 on attack.mitre.org

Its sub-techniques

MITRE ATT&CK

T1087.001Account Discovery: Local Account

T1087.002Account Discovery: Domain Account

Sigma rules tagged with it

process creation, the highest levels first

highChopper Webshell Process PatternFlorian Roth (Nextron Systems), MSTI (query) · Windows

highHackTool - SOAPHound Execution@kostastsale · Windows

highHackTool - winPEAS ExecutionGeorg Lauenstein (sure[secure]) · Windows

highMalicious PowerShell Commandlets - ProcessCreationNasreddine Bencherchali (Nextron Systems) · Windows

highNetwork Reconnaissance ActivityFlorian Roth (Nextron Systems) · Windows

highPotential Pikabot Discovery ActivityAndreas Braathen (mnemonic.io) · Windows

highPUA - Seatbelt ExecutionNasreddine Bencherchali (Nextron Systems) · Windows

highWebshell Detection With Command Line KeywordsFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson · Windows

highWebshell Hacking Activity PatternsFlorian Roth (Nextron Systems) · Windows

mediumPotentially Suspicious EventLog Recon Activity Using Log Query UtilitiesNasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) · Windows

mediumSuspicious Use of PsLogListNasreddine Bencherchali (Nextron Systems) · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Convert the PowerShell event log to CSV on the page for ConvertTo-Csv

(Get-Culture).TextInfo.ListSeparator
Get-WinEvent -LogName 'Windows PowerShell' | ConvertTo-Csv -UseCulture -NoTypeInformation

Identify

Create a web page to display PowerShell events on the page for ConvertTo-Html

Get-EventLog -LogName "Windows PowerShell" | ConvertTo-Html | Out-File pslog.htmIdentify

Create a web page to display PowerShell events on the page for ConvertTo-Html

Get-EventLog -Log "Windows PowerShell" | ConvertTo-Html -Property Id, Level, TaskIdentify

Configure the classic Security log on the page for Get-WinEvent

$log = Get-WinEvent -ListLog Security
$log.MaximumSizeInBytes = 1gb
try{
$log.SaveChanges()
Get-WinEvent -ListLog Security | Format-List -Property *
}catch [System.UnauthorizedAccessException]{
$ErrMsg = 'You don't have permission to configure this log!'
$ErrMsg += ' Try running this script with administrator privileges. '
$ErrMsg += $_.Exception.Message
Write-Error $ErrMsg
}

Identify

Get log information from event object properties on the page for Get-WinEvent

$Event = Get-WinEvent -LogName 'Windows PowerShell'
$Event.Count
$Event | Group-Object -Property Id -NoElement |
Sort-Object -Property Count -Descending
$Event | Group-Object -Property LevelDisplayName -NoElement

Identify

Invoke a command with a scriptblock stored in a variable on the page for Invoke-Command

$command = {
Get-EventLog -LogName 'Windows PowerShell' |
Where-Object { $_.Message -like 'certificate' }
}
Invoke-Command -ComputerName S1, S2 -ScriptBlock $command

Identify

Run a single command on several computers on the page for Invoke-Command

$parameters = @{
ComputerName = 'Server01', 'Server02', 'TST-0143', 'localhost'
ConfigurationName = 'MySession.PowerShell'
ScriptBlock = { Get-EventLog 'Windows PowerShell' }
}
Invoke-Command @parameters

Identify

Include local variables in a command run on a remote computer on the page for Invoke-Command

$Log = 'Windows PowerShell'
Invoke-Command -ComputerName Server01 -ScriptBlock {
Get-EventLog -LogName $Using:Log -Newest 10
}

Identify

Measure a command on the page for Measure-Command

Measure-Command { Get-EventLog "Windows PowerShell" }Identify

Select newest and oldest events in the event log on the page for Select-Object

$a = Get-EventLog -LogName "Windows PowerShell"
$a | Select-Object -Index 0, ($A.Count - 1)

Identify

Suspend a workflow job by name on the page for Suspend-Job

#Sample Workflow
workflow Get-SystemLog
{
$Events = Get-WinEvent -LogName System
CheckPoint-Workflow
inlinescript {\\Server01\Scripts\Analyze-SystemEvents.ps1 -Events $Events}
}
Get-SystemLog -AsJob -JobName "LogflowJob"
Get-Job -Name LogflowJob

Identify

Decrypt an encrypted event log message on the page for Unprotect-CmsMessage

$event = Get-WinEvent Microsoft-Windows-PowerShell/Operational -MaxEvents 1 |
Where-Object Id -EQ 4104
Unprotect-CmsMessage -EventLogRecord $event

Identify

And 1 more example on CmdID’s program pages.

An example is here when CmdID’s reading of it names T1087: a Sigma rule it trips is tagged with it, or its abuse is documented as it.