T1087

Account Discovery

Discovery Last updated:

Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers. Adversaries may use several methods to enumerate accounts, including abuse of existing tools, built-in commands, and potential misconfigurations that leak account names and roles or permissions in the targeted environment. On Windows, common discovery methods include net user, net localgroup, wmic useraccount list, Get-LocalUser, and Get-ADUser. On Linux and macOS, adversaries may read /etc/passwd, use getent, id, last, and who commands. In cloud environments, CLIs such as aws iam list-users, az ad user list, and gcloud iam service-accounts list are commonly abused. Observed threat actors leveraging this technique include Aquatic Panda, Scattered Spider, FIN13, and malware families such as Woody RAT, Havoc, TONESHELL, and ShimRatReporter.

What is T1087 Account Discovery?

Account Discovery (T1087) maps to the Discovery tactic — the adversary is trying to figure out your environment in MITRE ATT&CK.

This page provides production-ready detection logic for Account Discovery, covering the data sources and telemetry it touches: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint. The queries below are rated medium severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Discovery
Technique
T1087 Account Discovery
Canonical reference
https://attack.mitre.org/techniques/T1087/
Microsoft Sentinel / Defender
kusto 
let AccountDiscoveryProcesses = dynamic([
  "net.exe", "net1.exe", "wmic.exe", "dsquery.exe", "nltest.exe", "whoami.exe"
]);
let AccountDiscoveryCmdPatterns = dynamic([
  "net user", "net localgroup", "net group",
  "wmic useraccount", "wmic group",
  "dsquery user", "dsquery group",
  "Get-LocalUser", "Get-LocalGroup", "Get-ADUser", "Get-ADGroupMember",
  "nltest /dclist", "nltest /domain_trusts",
  "whoami /groups", "whoami /all",
  "query user", "quser"
]);
let PSAccountDiscovery = dynamic([
  "Get-LocalUser", "Get-LocalGroup", "Get-ADUser",
  "Get-ADGroupMember", "Get-ADObject", "Get-ADPrincipalGroupMembership",
  "[adsi]", "DirectorySearcher", "DirectoryEntry"
]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (
    (FileName in~ (AccountDiscoveryProcesses) and ProcessCommandLine has_any (AccountDiscoveryCmdPatterns))
    or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any (PSAccountDiscovery))
    or (ProcessCommandLine has "whoami" and ProcessCommandLine has_any ("/groups", "/all", "/priv"))
  )
| extend IsEncodedPS = (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any ("-enc", "-EncodedCommand"))
| extend NetUserDomain = (ProcessCommandLine has "net user" and ProcessCommandLine has "/domain")
| extend LocalGroupEnum = (ProcessCommandLine has_any ("net localgroup", "Get-LocalGroup", "wmic group"))
| extend PrivilegedGroupEnum = (ProcessCommandLine has_any ("administrators", "domain admins", "enterprise admins", "schema admins"))
| extend WMICEnum = (FileName =~ "wmic.exe" and ProcessCommandLine has_any ("useraccount", "group"))
| extend DSQueryEnum = (FileName =~ "dsquery.exe")
| project Timestamp, DeviceName, AccountName, AccountDomain,
         FileName, ProcessCommandLine, ProcessId,
         InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId,
         IsEncodedPS, NetUserDomain, LocalGroupEnum, PrivilegedGroupEnum, WMICEnum, DSQueryEnum
| sort by Timestamp desc

Detects account discovery activity using Microsoft Defender for Endpoint DeviceProcessEvents. Identifies Windows built-in tools (net.exe, net1.exe, wmic.exe, dsquery.exe, nltest.exe, whoami.exe) and PowerShell cmdlets (Get-LocalUser, Get-ADUser, Get-ADGroupMember) used to enumerate local accounts, domain accounts, and group memberships. Enriches each event with boolean flags for encoded PowerShell, domain-level enumeration, local group enumeration, privileged group targeting, WMI-based enumeration, and directory query usage. High-fidelity signals include privileged group enumeration and domain-level queries from non-administrative processes.

medium severity medium confidence

Data Sources

Process: Process Creation Command: Command Execution Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents

False Positives

  • IT administrators running net user or Get-ADUser as part of routine account auditing and helpdesk workflows
  • Endpoint management agents (SCCM, Intune, Tanium) that enumerate local accounts during inventory collection
  • Security scanning tools (Nessus, Qualys, CrowdStrike Spotlight) performing authenticated enumeration for vulnerability assessment
  • HR and IAM automation scripts that synchronize user lists between directories (e.g., Azure AD Connect, Okta provisioning)
  • Monitoring and SIEM agents that collect account information for baseline and compliance reporting
  • Developer tools and CI/CD pipelines that resolve user identities during build or deployment processes

Sigma rule & cross-platform mapping

The detection logic for Account Discovery (T1087) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1087 Sigma rules on detection.fyi

Platform-specific guides for T1087

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-17 Research depth: deep
References (10)

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Local Account Enumeration via Net User

    Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\net.exe and CommandLine='net user'. Net1.exe may also appear as a child process. Security Event ID 4688 (if command line auditing enabled) with the same detail. No network connections expected — local SAM database query only.

  2. Test 2Domain Account and Group Enumeration via Net

    Expected signal: Sysmon Event ID 1: Three sequential Process Create events for net.exe with CommandLines 'net user /domain', 'net group Domain Admins /domain', 'net group Enterprise Admins /domain'. Sysmon Event ID 3: Network connections to domain controller IP on port 445 (SMB/SAMR protocol for domain queries). Security Event IDs 4661/4662 on the domain controller for directory object access.

  3. Test 3Active Directory Enumeration via PowerShell Get-ADUser

    Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe and CommandLine containing 'Get-ADUser' and '-Filter *'. Sysmon Event ID 3: LDAP connection (port 389 or 3268 for global catalog) from powershell.exe to domain controller IP. PowerShell ScriptBlock Logging Event ID 4104 with full script content. Domain Controller Security Event IDs 4661/4662 for directory service access.

  4. Test 4WMI-Based Local Account Enumeration

    Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\wbem\WMIC.exe and CommandLine='wmic useraccount list brief'. Possible WMI provider process creation (WmiPrvSE.exe). No network connections for local query. Security Event ID 4688 with command line if auditing enabled.

  5. Test 5dsquery Domain User Enumeration

    Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\dsquery.exe and CommandLine='dsquery user -limit 0'. Sysmon Event ID 3: LDAP connection from dsquery.exe to domain controller on port 389 or 3268. Security Event IDs 4661/4662 on domain controller for directory access.

Response Playbook

Triage

  1. Identify the user account running the discovery commands — is it a service account, domain admin, standard user, or a newly created account? Privileged accounts performing discovery on systems they don't normally administer are high-fidelity signals.
  2. Examine the parent process — was the account discovery command spawned by a common attacker staging process (cmd.exe launched by Office, mshta.exe, wscript.exe, powershell.exe, or a remote admin tool like psexec.exe)? Legitimate admin tools typically launch from management frameworks, not Office or script interpreters.
  3. Review the timing context — did this discovery activity occur immediately after a logon event (4624), especially a network logon (Logon Type 3) or a batch/service logon (Types 4/5)? Chained logon + discovery within minutes is a strong compromise indicator.
  4. Check the scope and breadth of discovery — a single 'net user' is low risk; multiple commands across users, groups, domains, and trust relationships within a short window suggests automated post-exploitation (Cobalt Strike, Havoc, Sliver reconnaissance modules).
  5. Determine if privileged groups were specifically targeted — queries for 'Domain Admins', 'Enterprise Admins', 'Administrators' indicate the adversary is mapping privilege paths for lateral movement or privilege escalation.
  6. Correlate with lateral movement indicators — check for RDP logons (Event ID 4624 Logon Type 10), PsExec service installs (Event ID 7045), or WMI remote execution within the same time window on the same or adjacent systems.
  7. Review network telemetry — check whether LDAP queries (port 389/636/3268) were initiated from the affected host to domain controllers, which would indicate active directory enumeration beyond simple local commands.

Containment

  1. If automated tooling or C2 framework is suspected: immediately isolate the affected endpoint using EDR network isolation or VLAN quarantine to prevent further reconnaissance and lateral movement.
  2. If a compromised user credential is confirmed: disable the account in Active Directory, revoke all active sessions (Kerberos tickets and OAuth tokens), and force password reset across connected SaaS applications.
  3. If a service account was used for enumeration: rotate the service account credential immediately, audit all services using that account, and check for any scheduled tasks or services created under the compromised account.
  4. If domain-level enumeration occurred from a workstation: treat the entire workstation as compromised — do not simply remove the alert. Escalate to full incident response, including memory acquisition before reimaging.
  5. Block outbound LDAP (ports 389, 636, 3268, 3269) from non-server endpoints to domain controllers if not already restricted, to prevent further AD enumeration from the compromised host or neighboring hosts.

Evidence Collection

  1. Windows Security Event ID 4688 (with process command line auditing enabled) or Sysmon Event ID 1 — full command line of the discovery process and its parent chain.
  2. Windows Security Event ID 4624/4625 — logon events on the affected host in the 30 minutes preceding discovery activity, to identify initial access method and origin IP.
  3. Windows Security Event ID 4648 — explicit credential use (RunAs), which may indicate the adversary pivoted using harvested credentials before performing discovery.
  4. Sysmon Event ID 3 (Network Connection) — check for LDAP connections from the endpoint to domain controllers during the discovery window.
  5. PowerShell ScriptBlock Logging Event ID 4104 — if PowerShell-based AD enumeration was used, this will capture the full deobfuscated script content including any LDAP filter strings.
  6. Windows Security Event IDs 4661/4662 on domain controllers — object access events for Active Directory that correspond to LDAP queries issued by the compromised host.
  7. Memory image of the affected system (via EDR or tools like WinPmem) if a C2 framework is suspected — process memory will contain injected shellcode or framework artifacts.
  8. Prefetch files: C:\Windows\Prefetch\NET.EXE-*.pf, WMIC.EXE-*.pf, DSQUERY.EXE-*.pf — provide execution timestamps and frequency counts for discovery binaries.

Escalation Criteria

  • ! Discovery commands executed by SYSTEM, a service account, or a domain admin account outside of documented maintenance windows — indicates post-exploitation activity.
  • ! Multiple account discovery techniques used in rapid succession (net user + net localgroup + dsquery + nltest within minutes) — strongly suggests automated post-exploitation framework reconnaissance.
  • ! Privileged group membership specifically targeted (Domain Admins, Enterprise Admins, Schema Admins) — adversary is mapping privilege escalation and lateral movement paths.
  • ! Account discovery preceded or followed by lateral movement events (PsExec service install, WMI remote process creation, RDP logon from the same source) within the same time window.
  • ! Discovery commands spawned by an unusual parent process (Office application, browser, script interpreter, or a process running from a temp or user-writable directory).
  • ! The discovering host is a non-administrative workstation or a server that has no legitimate reason to query domain account structures.
  • ! LDAP queries observed from the host to domain controllers coinciding with the discovery process events — indicates active directory harvesting beyond local enumeration.

Investigation Guide

Forensic Artifacts

  • > Windows Event Log: Security — Event ID 4688 with process command line containing net user/localgroup/dsquery/wmic commands (requires command line auditing GPO enabled)
  • > Windows Event Log: Security on Domain Controllers — Event IDs 4661 and 4662 for Active Directory object access queries initiated during the discovery window
  • > Windows Event Log: Security — Event ID 4624 (successful logon) and 4648 (explicit credential logon) in the 30 minutes preceding discovery activity
  • > Sysmon Event Log — Event ID 1 (Process Create) with full command line, parent process details, and user context
  • > Sysmon Event Log — Event ID 3 (Network Connection) from discovery processes, particularly LDAP connections to DCs on port 389/3268
  • > Prefetch files: C:\Windows\Prefetch\NET.EXE-*.pf, NET1.EXE-*.pf, WMIC.EXE-*.pf, DSQUERY.EXE-*.pf, NLTEST.EXE-*.pf — execution timestamps and count
  • > PowerShell ScriptBlock Logging: Microsoft-Windows-PowerShell/Operational Event ID 4104 — deobfuscated content of any PowerShell-based enumeration scripts
  • > ConsoleHost_history.txt: %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt — command history including Get-ADUser, Get-LocalUser calls
  • > Windows Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU — recent Run dialog commands that may include discovery commands
  • > Linux /var/log/auth.log or /var/log/secure — last, who, id, getent commands logged with user context if auditd is configured
  • > Linux auditd logs — syscall audit records for execve calls to /bin/cat, /usr/bin/getent, /bin/id, /usr/bin/last on systems running auditd

Tuning Guidance

Account discovery is extremely common in enterprise environments, so effective tuning requires layered baselining rather than broad suppression. Start by identifying the specific processes, user accounts, and parent process combinations that constitute legitimate administrative activity in your environment. Common legitimate patterns include: SCCM/Intune agent processes (CcmExec.exe, IntuneManagementExtension.exe) running net user during inventory; monitoring agents (NessusAgent.exe, CrowdStrike, Carbon Black) running system queries; and IT admin workstations running Get-ADUser via PowerShell ISE or VSCode. Build allowlists based on specific (parent_process, user, device_type) tuples rather than suppressing entire command patterns. The highest-fidelity signals to prioritize regardless of allowlisting are: (1) account discovery from hosts with no admin baseline, (2) discovery targeting privileged groups (Domain Admins, Enterprise Admins), (3) discovery preceded by network logon events (Logon Type 3) from external IPs, and (4) five or more distinct discovery commands within a 10-minute window from a single process tree. For environments with heavy LDAP-based enumeration (large Active Directory deployments), consider focusing detections on the domain controller side (Event IDs 4661/4662) to identify anomalous query volumes rather than endpoint-side process creation events.

Hunting Queries

Hunt for accounts or processes performing high-volume account discovery within a 30-minute window across multiple hosts. Five or more discovery commands, or execution across more than two devices, from a single account is a strong indicator of automated post-exploitation framework reconnaissance (Cobalt Strike, Havoc, Sliver) versus manual admin activity.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("net.exe", "net1.exe", "wmic.exe", "dsquery.exe", "nltest.exe")
  or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any ("Get-ADUser", "Get-LocalUser", "Get-ADGroupMember", "Get-LocalGroupMember"))
| summarize
    CommandCount = count(),
    UniqueCommands = dcount(ProcessCommandLine),
    UniqueTargets = dcount(DeviceName),
    Commands = make_set(ProcessCommandLine, 10),
    Earliest = min(Timestamp),
    Latest = max(Timestamp)
  by AccountName, AccountDomain, InitiatingProcessFileName
| where CommandCount >= 5 or UniqueTargets > 2
| extend DurationMinutes = datetime_diff('minute', Latest, Earliest)
| where DurationMinutes < 30
| sort by CommandCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  ((Image="*\\net.exe" OR Image="*\\net1.exe" OR Image="*\\wmic.exe" OR Image="*\\dsquery.exe" OR Image="*\\nltest.exe")
  OR (Image="*\\powershell.exe" AND (CommandLine="*Get-ADUser*" OR CommandLine="*Get-LocalUser*" OR CommandLine="*Get-ADGroupMember*")))
| bin _time span=30m
| stats count as CommandCount, dc(CommandLine) as UniqueCommands, dc(host) as UniqueHosts, values(CommandLine) as Commands by User, _time
| where CommandCount >= 5 OR UniqueHosts > 2
| sort - CommandCount

Hunt for targeted enumeration of high-value privileged groups (Domain Admins, Enterprise Admins, Schema Admins, Backup Operators) correlated with recent network or interactive logon events on the same host. This pairing — remote logon followed by privileged group enumeration — is characteristic of an adversary who has just obtained initial foothold and is immediately mapping privilege escalation paths.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("net.exe", "net1.exe", "dsquery.exe", "nltest.exe", "wmic.exe")
  and ProcessCommandLine has_any ("domain admins", "enterprise admins", "schema admins", "administrators", "backup operators", "account operators", "domain controllers")
| project Timestamp, DeviceName, AccountName, AccountDomain, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine
| join kind=leftouter (
    DeviceLogonEvents
    | where Timestamp > ago(7d)
    | where LogonType in (3, 10)
    | project LogonTime=Timestamp, DeviceName, LogonAccountName=AccountName, RemoteIP, LogonType
  ) on DeviceName
| where LogonTime between ((Timestamp - 15min) .. (Timestamp + 5min))
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName,
         LogonAccountName, RemoteIP, LogonType, LogonTime
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\net.exe" OR Image="*\\net1.exe" OR Image="*\\dsquery.exe" OR Image="*\\nltest.exe")
  (CommandLine="*domain admins*" OR CommandLine="*enterprise admins*" OR CommandLine="*schema admins*" OR CommandLine="*administrators*" OR CommandLine="*backup operators*")
| eval discovery_time=_time
| append [
    search index=wineventlog sourcetype="WinEventLog:Security" EventCode=4624 (Logon_Type=3 OR Logon_Type=10)
    | eval logon_time=_time
    | rename Account_Name as logon_account, Source_Network_Address as src_ip, Logon_Type as logon_type
  ]
| stats values(CommandLine) as DiscoveryCommands, values(src_ip) as SourceIPs, values(logon_type) as LogonTypes by host, User
| where isnotnull(DiscoveryCommands) AND isnotnull(SourceIPs)
| sort - _time

Hunt for account discovery commands spawned by suspicious parent processes — script interpreters (mshta, wscript, cscript), LOLBins (rundll32, regsvr32, msbuild), or cmd.exe with web or temp path references. Legitimate account discovery is typically initiated by management consoles, PowerShell sessions launched from a terminal, or scheduled task engines — not from web-delivered scripts or LOLBin chains. This pattern is characteristic of malware or phishing payloads performing immediate post-execution reconnaissance.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("net.exe", "net1.exe", "dsquery.exe", "wmic.exe", "nltest.exe")
  or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any ("Get-ADUser", "Get-LocalUser", "Get-ADGroupMember", "DirectorySearcher", "[adsi]"))
| where InitiatingProcessFileName in~ (
    "cmd.exe", "powershell.exe", "pwsh.exe",
    "mshta.exe", "wscript.exe", "cscript.exe",
    "rundll32.exe", "regsvr32.exe", "msbuild.exe",
    "explorer.exe"
  )
| where InitiatingProcessFileName !in~ ("powershell.exe", "pwsh.exe", "cmd.exe")
  or InitiatingProcessCommandLine has_any ("mshta", "wscript", "cscript", "http", "\\temp\\", "\\appdata\\", "%temp%", "%appdata%")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  ((Image="*\\net.exe" OR Image="*\\net1.exe" OR Image="*\\dsquery.exe" OR Image="*\\nltest.exe" OR Image="*\\wmic.exe")
  OR (Image="*\\powershell.exe" AND (CommandLine="*Get-ADUser*" OR CommandLine="*Get-LocalUser*" OR CommandLine="*DirectorySearcher*")))
  (ParentImage="*\\mshta.exe" OR ParentImage="*\\wscript.exe" OR ParentImage="*\\cscript.exe" OR ParentImage="*\\rundll32.exe" OR ParentImage="*\\regsvr32.exe" OR ParentImage="*\\msbuild.exe" OR (ParentImage="*\\cmd.exe" AND (ParentCommandLine="*http*" OR ParentCommandLine="*temp*" OR ParentCommandLine="*appdata*")))
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine
| sort - _time

Atomic Red Team Tests

Test 1 Local Account Enumeration via Net User
windows

Enumerates all local user accounts on the system using the built-in net.exe utility. This is one of the most commonly observed account discovery commands across multiple threat actor groups and malware families. Net.exe invokes net1.exe internally, so both binaries may appear in process telemetry.

Command

powershell 
net user

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\net.exe and CommandLine='net user'. Net1.exe may also appear as a child process. Security Event ID 4688 (if command line auditing enabled) with the same detail. No network connections expected — local SAM database query only.

Expected Detection

Alert fires on net.exe with 'net user' command pattern. KQL: FileName =~ 'net.exe' with ProcessCommandLine has 'net user'. SPL: NetUserEnum=1, DiscoveryScore >= 1.

Test 2 Domain Account and Group Enumeration via Net
windows

Performs domain-level account and group enumeration using net.exe with the /domain flag. This discovers all domain users and the membership of the Domain Admins group — a critical step adversaries take after initial compromise to identify privileged accounts for lateral movement targeting. Requires domain-joined host.

Command

powershell 
net user /domain & net group "Domain Admins" /domain & net group "Enterprise Admins" /domain

Expected Telemetry

Sysmon Event ID 1: Three sequential Process Create events for net.exe with CommandLines 'net user /domain', 'net group Domain Admins /domain', 'net group Enterprise Admins /domain'. Sysmon Event ID 3: Network connections to domain controller IP on port 445 (SMB/SAMR protocol for domain queries). Security Event IDs 4661/4662 on the domain controller for directory object access.

Expected Detection

Alert fires on net.exe with /domain flag and group enumeration of privileged groups. KQL: NetUserDomain=true AND PrivilegedGroupEnum=true. SPL: NetDomainEnum=1 AND PrivGroupTarget=1, DiscoveryScore >= 2. The combination of domain enumeration and privileged group targeting is a high-confidence signal.

Test 3 Active Directory Enumeration via PowerShell Get-ADUser
windows

Uses PowerShell's Active Directory module to enumerate all domain user accounts and export their usernames, email addresses, and account status. This is functionally equivalent to LDAP queries and represents the PowerShell-native path to domain account discovery used by threat actors with AD module access. Requires the AD module (RSAT or AD DS).

Command

powershell 
powershell.exe -Command "Import-Module ActiveDirectory; Get-ADUser -Filter * -Properties SamAccountName,EmailAddress,Enabled | Select-Object SamAccountName,EmailAddress,Enabled | Format-Table -AutoSize"

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=powershell.exe and CommandLine containing 'Get-ADUser' and '-Filter *'. Sysmon Event ID 3: LDAP connection (port 389 or 3268 for global catalog) from powershell.exe to domain controller IP. PowerShell ScriptBlock Logging Event ID 4104 with full script content. Domain Controller Security Event IDs 4661/4662 for directory service access.

Expected Detection

Alert fires on powershell.exe with Get-ADUser pattern. KQL: PSADEnum=true. SPL: PSADEnum=1, DiscoveryScore >= 1. LDAP connection correlated via hunting query 1.

Test 4 WMI-Based Local Account Enumeration
windows

Uses wmic.exe to enumerate local user accounts via the Win32_UserAccount WMI class. WMI-based discovery is favored by adversaries who want to avoid direct net.exe invocation, as it may evade simple command-line pattern matching focused on net.exe. WMIC can also be used remotely for lateral discovery.

Command

powershell 
wmic useraccount list brief

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\wbem\WMIC.exe and CommandLine='wmic useraccount list brief'. Possible WMI provider process creation (WmiPrvSE.exe). No network connections for local query. Security Event ID 4688 with command line if auditing enabled.

Expected Detection

Alert fires on wmic.exe with 'useraccount' in CommandLine. KQL: WMICEnum=true. SPL: WMICEnum=1, DiscoveryScore >= 1.

Test 5 dsquery Domain User Enumeration
windows

Uses dsquery.exe to search Active Directory for all user objects in the domain. dsquery is a built-in Windows Server tool that issues LDAP queries and outputs distinguished names. Adversaries use it to enumerate domain accounts and their organizational unit placement, which can reveal privileged service accounts and administrator accounts by naming convention.

Command

powershell 
dsquery user -limit 0

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\dsquery.exe and CommandLine='dsquery user -limit 0'. Sysmon Event ID 3: LDAP connection from dsquery.exe to domain controller on port 389 or 3268. Security Event IDs 4661/4662 on domain controller for directory access.

Expected Detection

Alert fires on dsquery.exe execution. KQL: DSQueryEnum=true. SPL: DSQueryEnum=1, DiscoveryScore >= 1. Dsquery has very few legitimate uses on non-server endpoints, making this a high-fidelity signal on workstations.

Related Detections

Tactic Hub

TA0007Discovery

Sub-techniques (4)

Related Techniques

T1087.001Local AccountT1087.002Domain AccountT1087.003Email AccountT1087.004Cloud AccountT1069Permission Groups DiscoveryT1069.001Local GroupsT1069.002Domain GroupsT1033System Owner/User DiscoveryT1078Valid AccountsT1110Brute ForceT1566PhishingT1021Remote ServicesT1136Create Account

Same Tactic: Discovery

Popular Detections