H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Tool

dsquery

[dsquery](https://attack.mitre.org/software/S0105) is a command-line utility that can be used to query Active Directory for information from a system within a domain. (Citation: TechNet Dsquery) It is typically installed only on Windows Server versions but can be installed on non-server variants through the Microsoft-provided Remote Server Administration Tools bundle.

Tool
TypeTool
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[dsquery](https://attack.mitre.org/software/S0105) is a command-line utility that can be used to query Active Directory for information from a system within a domain. (Citation: TechNet Dsquery) It is typically installed only on Windows Server versions but can be installed on non-server variants through the Microsoft-provided Remote Server Administration Tools bundle.

Labels

tool
9 recorded

Relationships

uses
from APT41
Group
uses
from C0017
Campaign
uses
to Domain Account
Technique
uses
to Domain Groups
Technique
uses
to Domain Trust Discovery
Technique
uses
to System Information Discovery
Technique
uses
from FIN8
Group
uses
from Operation CuckooBees
Campaign
uses
from Operation Wocao
Campaign
2 external

References

mitre-attack
S0105
open
TechNet Dsquery
https://technet.microsoft.com/en-us/library/cc732952.aspx
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance