Detect Account Discovery in Sumo Logic CSE
Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers. Adversaries may use several methods to enumerate accounts, including abuse of existing tools, built-in commands, and potential misconfigurations that leak account names and roles or permissions in the targeted environment. On Windows, common discovery methods include net user, net localgroup, wmic useraccount list, Get-LocalUser, and Get-ADUser. On Linux and macOS, adversaries may read /etc/passwd, use getent, id, last, and who commands. In cloud environments, CLIs such as aws iam list-users, az ad user list, and gcloud iam service-accounts list are commonly abused. Observed threat actors leveraging this technique include Aquatic Panda, Scattered Spider, FIN13, and malware families such as Woody RAT, Havoc, TONESHELL, and ShimRatReporter.
MITRE ATT&CK
- Tactic
- Discovery
- Technique
- T1087 Account Discovery
- Canonical reference
- https://attack.mitre.org/techniques/T1087/
Sumo Detection Query
_sourceCategory=endpoint/windows OR _sourceCategory=sysmon
| where EventCode = "1" OR EventCode = "4688"
| parse "Image=*" as full_image_path nodrop
| parse regex field=full_image_path "(?i)\\(?P<process_name>[^\\]+)$" nodrop
| parse "CommandLine=*" as command_line nodrop
| parse "ParentImage=*" as full_parent_path nodrop
| parse regex field=full_parent_path "(?i)\\(?P<parent_process_name>[^\\]+)$" nodrop
| parse "ParentCommandLine=*" as parent_command_line nodrop
| parse "User=*" as event_user nodrop
| where (
(in(toLowerCase(process_name), "net.exe", "net1.exe") and (toLowerCase(command_line) contains "net user" or toLowerCase(command_line) contains "net localgroup" or toLowerCase(command_line) contains "net group"))
or (toLowerCase(process_name) = "wmic.exe" and (toLowerCase(command_line) contains "useraccount" or toLowerCase(command_line) contains " group"))
or in(toLowerCase(process_name), "dsquery.exe", "nltest.exe")
or (toLowerCase(process_name) = "whoami.exe" and (toLowerCase(command_line) contains "/groups" or toLowerCase(command_line) contains "/all" or toLowerCase(command_line) contains "/priv"))
or (in(toLowerCase(process_name), "powershell.exe", "pwsh.exe") and (
toLowerCase(command_line) contains "get-localuser" or toLowerCase(command_line) contains "get-localgroup" or
toLowerCase(command_line) contains "get-aduser" or toLowerCase(command_line) contains "get-adgroupmember" or
toLowerCase(command_line) contains "get-adobject" or toLowerCase(command_line) contains "get-adprincipalgroup" or
toLowerCase(command_line) contains "directorysearcher" or toLowerCase(command_line) contains "directoryentry"
))
)
| eval NetUserEnum = if(toLowerCase(command_line) contains "net user", 1, 0)
| eval NetGroupEnum = if(toLowerCase(command_line) contains "net localgroup" or toLowerCase(command_line) contains "net group", 1, 0)
| eval NetDomainEnum = if(toLowerCase(command_line) contains "/domain", 1, 0)
| eval WMICEnum = if(toLowerCase(process_name) = "wmic.exe" and (toLowerCase(command_line) contains "useraccount" or toLowerCase(command_line) contains " group"), 1, 0)
| eval DSQueryEnum = if(toLowerCase(process_name) = "dsquery.exe", 1, 0)
| eval NLTestEnum = if(toLowerCase(process_name) = "nltest.exe", 1, 0)
| eval WhoamiEnum = if(toLowerCase(command_line) contains "/groups" or toLowerCase(command_line) contains "/all" or toLowerCase(command_line) contains "/priv", 1, 0)
| eval PSLocalEnum = if(toLowerCase(command_line) contains "get-localuser" or toLowerCase(command_line) contains "get-localgroup", 1, 0)
| eval PSADEnum = if(toLowerCase(command_line) contains "get-aduser" or toLowerCase(command_line) contains "get-adgroupmember", 1, 0)
| eval PrivGroupTarget = if(toLowerCase(command_line) contains "administrators" or toLowerCase(command_line) contains "domain admins" or toLowerCase(command_line) contains "enterprise admins", 1, 0)
| eval DiscoveryScore = NetUserEnum + NetGroupEnum + WMICEnum + DSQueryEnum + NLTestEnum + WhoamiEnum + PSLocalEnum + PSADEnum
| where DiscoveryScore > 0
| fields _messageTime, _sourceHost, event_user, process_name, command_line, parent_process_name, parent_command_line, NetUserEnum, NetGroupEnum, NetDomainEnum, WMICEnum, DSQueryEnum, NLTestEnum, WhoamiEnum, PSLocalEnum, PSADEnum, PrivGroupTarget, DiscoveryScore
| sort by _messageTime descDetects account discovery activity in Sumo Logic by parsing Sysmon Event ID 1 and Windows Security Event ID 4688 process creation events. Identifies use of net.exe, wmic.exe, dsquery.exe, nltest.exe, whoami.exe, and PowerShell AD cmdlets with a scoring model to surface high-fidelity alerts for MITRE ATT&CK T1087.
Data Sources
Required Tables
False Positives & Tuning
- System administrators running net.exe, dsquery.exe, or PowerShell AD scripts as part of scheduled user account inventory or compliance audits
- Managed service providers using PowerShell AD cmdlets for regular AD health checks, reporting, or group membership reconciliation
- Automated onboarding and offboarding workflows that enumerate group membership before modifying user accounts
Other platforms for T1087
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Local Account Enumeration via Net User
Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\net.exe and CommandLine='net user'. Net1.exe may also appear as a child process. Security Event ID 4688 (if command line auditing enabled) with the same detail. No network connections expected — local SAM database query only.
- Test 2Domain Account and Group Enumeration via Net
Expected signal: Sysmon Event ID 1: Three sequential Process Create events for net.exe with CommandLines 'net user /domain', 'net group Domain Admins /domain', 'net group Enterprise Admins /domain'. Sysmon Event ID 3: Network connections to domain controller IP on port 445 (SMB/SAMR protocol for domain queries). Security Event IDs 4661/4662 on the domain controller for directory object access.
- Test 3Active Directory Enumeration via PowerShell Get-ADUser
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe and CommandLine containing 'Get-ADUser' and '-Filter *'. Sysmon Event ID 3: LDAP connection (port 389 or 3268 for global catalog) from powershell.exe to domain controller IP. PowerShell ScriptBlock Logging Event ID 4104 with full script content. Domain Controller Security Event IDs 4661/4662 for directory service access.
- Test 4WMI-Based Local Account Enumeration
Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\wbem\WMIC.exe and CommandLine='wmic useraccount list brief'. Possible WMI provider process creation (WmiPrvSE.exe). No network connections for local query. Security Event ID 4688 with command line if auditing enabled.
- Test 5dsquery Domain User Enumeration
Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\dsquery.exe and CommandLine='dsquery user -limit 0'. Sysmon Event ID 3: LDAP connection from dsquery.exe to domain controller on port 389 or 3268. Security Event IDs 4661/4662 on domain controller for directory access.
References (11)
- https://attack.mitre.org/techniques/T1087/
- https://docs.aws.amazon.com/cli/latest/reference/iam/list-users.html
- https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/list
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/net-user
- https://learn.microsoft.com/en-us/windows/win32/wmisdk/wmi-start-page
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc732952(v=ws.11)
- https://www.elastic.co/security-labs/embracing-offensive-tooling-building-detections-against-koadic-using-eql
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1087/T1087.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
- https://www.crowdstrike.com/blog/2022-falcon-overwatch-report/
- https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico
Unlock Pro Content
Get the full detection package for T1087 including response playbook, investigation guide, and atomic red team tests.