Account Discovery: Domain Account

AdFind can enumerate domain users.^[1][2][3]

Bankshot gathers domain and account names/information through process monitoring.^[4]

Bazar has the ability to identify domain administrator accounts.^[5][6]

BloodHound can collect information about domain users, including identification of domain admin accounts.^[7]

BoomBox has the ability to execute an LDAP query to enumerate the distinguished name, SAM account name, and display name for all domain users.^[8]

BRONZE BUTLER has used net user /domain to identify account information.^[9]

Chimera has has used net user /dom and net user Administrator to enumerate domain accounts including administrator accounts.^[10][11]

Cobalt Strike can determine if the user on an infected machine is in the admin or domain admin group.^[12]

CrackMapExec can enumerate the domain user accounts on a targeted system.^[13]

Dragonfly 2.0 used batch scripts to enumerate users on a victim domain controller.^[14]

dsquery can be used to gather information on user accounts within a domain.^[15]

Empire can acquire local and domain user account information.^[16]

FIN6 has used Metasploit’s PsExec NTDSGRAB module to obtain a copy of the victim's Active Directory database.^[17]

Fox Kitten has used the Softerra LDAP browser to browse documentation on service accounts.^[18]

IcedID can query LDAP to identify additional users on the network to infect.^[19]

Ke3chang performs account discovery using commands such as net localgroup administrators and net group "REDACTED" /domain on specific permissions groups.^[20]

menuPass has used the Microsoft administration tool csvde.exe to export Active Directory data.^[21]

MuddyWater has used cmd.exe net user /domain to enumerate domain users.^[22]

Net commands used with the /domain flag can be used to gather information about and manipulate user accounts on the current domain.^[23]

OilRig has run net user, net user /domain, net group "domain admins" /domain, and net group "Exchange Trusted Subsystem" /domain to get account listings on a victim.^[24]

Operation Wocao has used the net command to retrieve information about domain accounts.^[25]

OSInfo enumerates local and domain users^[26]

Poseidon Group searches for administrator accounts on both the local victim machine and the network.^[27]

PoshC2 can enumerate local and domain user account information.^[28]

POWRUNER may collect user account information by running net user /domain or a series of other commands on a victim.^[29]

Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about usernames listed in AD.^[30]

SoreFang can enumerate domain accounts via net.exe user /domain.^[31]

Stuxnet enumerates user accounts of the domain.^[32]

Sykipot may use net group "domain admins" /domain to display accounts in the "domain admins" permissions group and net localgroup "administrators" to list local system administrator group membership.^[33]

Turla has used net user /domain to enumerate domain accounts.^[34]

Valak has the ability to enumerate domain admin accounts.^[35]

Wizard Spider has identified domain admins through the use of "net group ‘Domain admins’" commands.^[6]

Prevent administrator accounts from being enumerated when an application is elevating through UAC since it can lead to the disclosure of account names. The Registry key is located at HKLM\ SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\EnumerateAdministrators. It can be disabled through GPO: Computer Configuration > [Policies] > Administrative Templates > Windows Components > Credential User Interface: Enumerate administrator accounts on elevation.^[36]