H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Technique

Domain Account

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges. Commands such as net user /domain and net group /domain of the [Net](https://attack.mitre.org/software/S0039) utility, dscacheutil -q group on macOS, and ldapsearch on Linux can list domain users and groups. [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets including Get-ADUser and Get-ADGroupMember may enumerate members of Active Directory groups.(Citation: CrowdStrike StellarParticle January 2022)

Technique
TypeTechnique
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges. Commands such as net user /domain and net group /domain of the [Net](https://attack.mitre.org/software/S0039) utility, dscacheutil -q group on macOS, and ldapsearch on Linux can list domain users and groups. [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets including Get-ADUser and Get-ADGroupMember may enumerate members of Active Directory groups.(Citation: CrowdStrike StellarParticle January 2022)

63 recorded

Relationships

mitigates
from Operating System Configuration
Mitigation
subtechnique-of
to Account Discovery
Technique
uses
from AdFind
Tool
uses
from APT41
Group
uses
from Bankshot
Malware
uses
from Bazar
Malware
uses
from BlackByte
Group
uses
from BlackCat
Malware
uses
from BloodHound
Tool
uses
from BoomBox
Malware
uses
from BRONZE BUTLER
Group
uses
from Brute Ratel C4
Tool
uses
from Chimera
Group
uses
from Cobalt Strike
Malware
uses
from CrackMapExec
Tool
uses
from Dragonfly
Group
uses
from dsquery
Tool
uses
from DUSTTRAP
Malware
uses
from Empire
Tool
uses
from FIN13
Group
uses
from FIN6
Group
uses
from FIN7
Group
uses
from Fox Kitten
Group
uses
from IceApple
Malware
uses
from IcedID
Malware
uses
from INC Ransom
Group
uses
from Ke3chang
Group
uses
from LAMEHUG
Malware
uses
from LAPSUS$
Group
uses
from Latrodectus
Malware
uses
from Lotus Blossom
Group
uses
from menuPass
Group
uses
from MgBot
Malware
uses
from MirrorFace
Group
uses
from MuddyWater
Group
uses
from Mustang Panda
Group
uses
from Net
Tool
uses
from OilRig
Group
uses
from Operation CuckooBees
Campaign
uses
from Operation Dream Job
Campaign
uses
from Operation Wocao
Campaign
uses
from OSInfo
Malware
uses
from Poseidon Group
Group
uses
from PoshC2
Tool
uses
from POWRUNER
Malware
uses
from Qilin
Malware
uses
from RedCurl
Group
uses
from RustyWater
Malware
uses
from Sandworm Team
Group
uses
from Scattered Spider
Group
uses
from SILENTTRINITY
Tool
uses
from SolarWinds Compromise
Campaign
uses
from SoreFang
Malware
uses
from Storm-0501
Group
uses
from Storm-1811
Group
uses
from Stuxnet
Malware
uses
from Sykipot
Malware
uses
from ToddyCat
Group
uses
from Turla
Group
uses
from Valak
Malware
uses
from VOID MANTICORE
Group
uses
from Volt Typhoon
Group
uses
from Wizard Spider
Group
2 external

References

mitre-attack
T1087.002
open
CrowdStrike StellarParticle January 2022
https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance