Domain Account discovery (T1087.002) is the sub-technique of Account Discovery that lists accounts in a directory such as Active Directory. It sits in the discovery tactic and applies to Linux, macOS and Windows.
How attackers use it
MITRE says adversaries may list domain accounts to learn which exist, which helps in follow-on behavior such as targeting specific accounts that hold particular privileges. In other words, it is how an intruder finds the administrators.
The page names these ways of listing domain users and groups:
- Windows: net user /domain and net group /domain from the Net utility.
- macOS: dscacheutil -q group.
- Linux: ldapsearch.
- PowerShell cmdlets such as Get-ADUser and Get-ADGroupMember, which can list members of Active Directory groups.
How to detect it
MITRE's strategy (DET0129) offers three analytics:
- Windows: enumeration with net.exe, PowerShell, WMI or LDAP queries coming from non-domain controllers or non-admin endpoints.
- Linux: ldapsearch, samba tools such as wbinfo -u, or winbindd lookups.
- macOS: group and user enumeration with dscl or dscacheutil, or directory queries from non-admin endpoints.
The strongest idea in this list is source. Directory queries from a normal user workstation, especially a burst of them, are far less common than queries from admin hosts. Log directory service activity and process command lines, and keep a list of hosts that are expected to query the directory at volume.
How to reduce the risk
MITRE lists one mitigation, Operating System Configuration. Prevent administrator accounts from being enumerated when an application is elevating through UAC, since it can disclose account names. The registry value is EnumerateAdministrators under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI. Group policy can manage it under Computer Configuration, Administrative Templates, Windows Components, Credential User Interface.
Check your own environment
- Which workstations ever query the directory in bulk? Does the list match your expectations?
- Do you log process command lines on workstations?
- Is the UAC enumeration setting configured by policy?
A read-only way to see the current value on a Windows machine:
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI /v EnumerateAdministrators
Quick check
Why does source matter when detecting domain account enumeration?
MITRE highlights queries coming from non-domain controllers or non-admin endpoints. Normal users rarely run bulk directory queries.
Sources
- MITRE ATT&CK, T1087.002 Domain Account: https://attack.mitre.org/techniques/T1087/002/
