Account Discovery (T1087) is how an intruder learns who exists in an environment. It belongs to the discovery tactic and applies to ESXi, IaaS, Identity Provider, Linux, macOS, Office Suite, SaaS and Windows. It has four sub-techniques: local, domain, email and cloud account discovery.
How attackers use it
MITRE says adversaries may try to get a list of valid accounts, usernames or email addresses on a system or in a compromised environment. Knowing which accounts exist can support follow-on behavior such as brute forcing, spear phishing and account takeover, including Valid Accounts abuse.
The methods named on the page include abusing existing tools, using built-in commands, and exploiting misconfigurations that leak account names, roles or permissions. Cloud environments typically offer easy interfaces to obtain user lists. On hosts, default PowerShell and other command line functions can identify accounts. Email addresses and accounts can also be found by searching files on an infected system.
How to detect it
MITRE's strategy (DET0587) has an analytic for each platform:
- Local and domain enumeration: processes that query account directories or security APIs, then produce a structured list.
- Linux: enumeration of users and groups through suspicious shell commands, or unauthorized access to /etc/passwd or /etc/shadow.
- Directory services: system utilities or directory queries that read account metadata stores, followed by structured output.
- Cloud: principals calling provider APIs to retrieve IAM users or roles in rapid succession.
- Identity directories: API calls or admin queries that pull many account objects in a short interval.
- ESXi: system processes querying host account configuration or management APIs.
- Office and SaaS: bulk access to user directory features or hidden APIs, and account discovery through VBA macros, COM objects or embedded scripting.
The shared pattern is volume and sequence: a lot of identity lookups in a short time, followed by a file or output that holds the results.
How to reduce the risk
MITRE lists two mitigations:
- Operating System Configuration. Stop administrator accounts from being listed when an application elevates through UAC, since that leaks account names. The relevant registry value is EnumerateAdministrators under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI, and it can be set with group policy under Administrative Templates, Windows Components, Credential User Interface.
- User Account Management. Manage the creation, modification, use and permissions of user accounts.
Check your own environment
- Who in your cloud tenants can list every user and role? Does it need to be everyone?
- Are directory query logs and cloud audit logs kept, and can you search for bursts of list calls?
- Do public pages or error messages expose usernames or roles?
On Windows, a read-only check of the UAC enumeration setting:
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI /v EnumerateAdministrators
If the value does not exist, the default behavior applies.
Quick check
What do adversaries gain from knowing which accounts exist?
It supports follow-on actions such as brute forcing, spear phishing and account takeover.
Sources
- MITRE ATT&CK, T1087 Account Discovery: https://attack.mitre.org/techniques/T1087/
