Techniques › T1087
T1087 Account Discovery
discovery — ESXi, IaaS, Identity Provider, Linux, macOS, Office Suite, SaaS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
8
analytics
16
Sigma rules tagged attack.t1087
6
KEV CVEs mapped here
<p>Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts).</p><p>Adversaries may use several methods to enumerate accounts, including abuse of existing tools, built-in commands, and potential misconfigurations that leak account names and roles or permissions in the targeted environment.</p><p>For examples, cloud environments typically provide easily accessible interfaces to obtain user lists. On hosts, adversaries can use default PowerShell and other command line functionality to identify accounts. Information about email addresses and accounts may also be extracted by searching an infected system’s files.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2024-13161 | Ivanti Endpoint Manager (EPM) | secondary impact | Mapped | 2025-03-10 |
| CVE-2024-13160 | Ivanti Endpoint Manager (EPM) | secondary impact | Mapped | 2025-03-10 |
| CVE-2024-13159 | Ivanti Endpoint Manager (EPM) | secondary impact | Mapped | 2025-03-10 |
| CVE-2023-27532 | Veeam Backup & Replication | secondary impact | Mapped | 2023-08-22 |
| CVE-2022-41082 | Microsoft Exchange Server | secondary impact | Mapped | 2022-09-30 |
| CVE-2021-44515 | Zoho Desktop Central | secondary impact | Mapped | 2021-12-10 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0587 Enumeration of User or Account Information Across Platforms v1.0
AN1612 WindowsDetection of processes performing local or domain account enumeration by invoking account directory queries or security APIs followed by structured output of account lists. The defender observes command execution or API invocation patterns that retrieve account information and produce enumeration artifacts shortly afterward.Tunable:
CommandLinePatternTimeWindowUserContextAN1613 LinuxEnumeration of users and groups through suspicious shell commands or unauthorized access to /etc/passwd or /etc/shadow.Tunable:AccessedFileParentProcessNameAN1614 macOSDetection of account enumeration through directory service queries or system utilities accessing account metadata stores, followed by structured enumeration output.macos:unifiedlogDirectoryService queries retrieving account information→ DC0013 User Account MetadataTunable:CommandLineExecutionContextAN1615 IaaSDetection of enumeration of identity entities through cloud provider APIs where principals retrieve account metadata such as IAM users or roles in rapid succession.Tunable:API_MethodCallerTypeAN1616 Identity ProviderDetection of identity directory enumeration through API calls or administrative queries retrieving multiple account objects within a short interval.Tunable:QueryTypeAppContextAN1617 ESXiDetection of enumeration activity when system processes query ESXi host account configuration or management APIs to retrieve user account listings.Tunable:CommandPatternPrivilegedSessionAN1618 SaaSAccount enumeration via bulk access to user directory features or hidden APIs.Tunable:EndpointURLUserAgentAN1619 Office SuiteAccount discovery via VBA macros, COM objects, or embedded scripting.Tunable:MacroNameExecutionScope
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1087
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-01-02 (modified 2025-12-10) · logsource: product=windows category=process_creation · 02030f2f-6199-49ec-b258-ea71b07e03dc
Detects Commandlet names from well-known PowerShell exploitation frameworks
Author: Florian Roth (Nextron Systems)
· 2017-05-31 (modified 2022-10-09) · logsource: product=windows service=security · 24549159-ac1b-479c-8175-d42aea947cae
This events that are generated when using the hacktool Ruler by Sensepost
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-10-18 (modified 2023-02-04) · logsource: product=windows category=process_creation · 38646daa-e78f-4ace-9de0-55547b2d30da
Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters
Author: Florian Roth (Nextron Systems)
· 2022-03-17 (modified 2023-11-09) · logsource: product=windows category=process_creation · 4ebc877f-4612-45cb-b3a5-8e3834db36c9
Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system
Author: Sagie Dulce, Dekel Paz
· 2022-01-01 · logsource: product=rpc_firewall category=application · 65f77b1e-8e79-45bf-bb67-5988a8ce45a5
Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.
Author: Andreas Braathen (mnemonic.io)
· 2023-10-27 (modified 2024-01-26) · logsource: product=windows category=process_creation · 698d4431-514f-4c82-af4d-cf573872a9f5
Detects system discovery activity carried out by Pikabot, such as incl. network, user info and domain groups.
The malware Pikabot has been seen to use this technique as part of its C2-botnet registration with a short collection time frame (less than 1 minute).
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-01-20 (modified 2025-12-10) · logsource: product=windows category=ps_module · 7d0d0329-0ef1-4e84-a9f5-49500f9d7c6c
Detects Commandlet names from well-known PowerShell exploitation frameworks
Author: Sean Metcalf, Florian Roth, Bartlomiej Czyz @bczyz1, oscd.community, Nasreddine Bencherchali, Tim Shelton, Mustafa Kaan Demir, Georg Lauenstein, Max Altgelt, Tobias Michalski, Austin Songer
· 2017-03-05 (modified 2025-12-10) · logsource: product=windows category=ps_script · 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6
Detects Commandlet names from well-known PowerShell exploitation frameworks
Author: Georg Lauenstein (sure[secure])
· 2022-09-19 (modified 2023-03-23) · logsource: product=windows category=process_creation · 98b53e78-ebaf-46f8-be06-421aafd176d9
WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz
Author: Nasreddine Bencherchali (Nextron Systems)
· 2021-12-18 (modified 2026-06-29) · logsource: product=windows category=process_creation · aae1243f-d8af-40d8-ab20-33fc6d0c55bc
Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery or delete events logs
Author: @kostastsale
· 2024-01-26 · logsource: product=windows category=network_connection · b3ad3c0f-c949-47a1-a30e-b0491ccae876
Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated with ADWS management.
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
· 2022-09-09 (modified 2025-12-02) · logsource: product=windows category=process_creation · beaa66d6-aa1b-4e3c-80f5-e0145369bfaf
Detects execution of different log query utilities and commands to search and dump the content of specific event logs or look for specific event IDs.
This technique is used by threat actors in order to extract sensitive information from events logs such as usernames, IP addresses, hostnames, etc.
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson
· 2017-01-01 (modified 2026-07-14) · logsource: product=windows category=process_creation · bed2a484-9348-4143-8a8a-b801c979301c
Detects certain command line parameters often used during reconnaissance activity via web shells
Author: Florian Roth (Nextron Systems)
· 2022-02-07 · logsource: product=windows category=process_creation · e6313acd-208c-44fc-a0ff-db85d572e90e
Detects a set of suspicious network related commands often used in recon stages
Author: @kostastsale
· 2024-01-26 · logsource: product=windows category=process_creation · e92a4287-e072-4a40-9739-370c106bb750
Detects the execution of SOAPHound, a .NET tool for collecting Active Directory data, using specific command-line arguments that may indicate an attempt to extract sensitive AD information.
Author: Florian Roth (Nextron Systems), MSTI (query)
· 2022-10-01 · logsource: product=windows category=process_creation · fa3c117a-bc0d-416e-a31b-0c0e80653efb
Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells