216.73.216.128

T1087.002: T1087.002

View on MITRE ATT&CK The MITRE Corporation · Published 21/02/2020 22:08 · Modified 15/04/2026 12:25

Essential information

MITRE technique ID
T1087.002
Confidence
100/100
Revoked
No
Published
21/02/2020 22:08
Modified
15/04/2026 12:25
Author / Source
The MITRE Corporation

Aliases

Domain Account

Platforms

windows macos linux

Description

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges. Commands such as `net user /domain` and `net group /domain` of the [Net](https://attack.mitre.org/software/S0039) utility, `dscacheutil -q group` on macOS, and `ldapsearch` on Linux can list domain users and groups. [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets including `Get-ADUser` and `Get-ADGroupMember` may enumerate members of Active Directory groups.(Citation: CrowdStrike StellarParticle January 2022)

Kill chain phases

Kill chainPhase
mitre-attack discovery

Marking (TLP)

TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.

External references

Related entities

Intrusion sets, malware, reports, vulnerabilities, indicators and other entities linked to this technique.