Technique:  Account Discovery:Domain Account
AdFind can enumerate domain users.
Bankshot gathers domain and account names/information through process monitoring.
Bazar has the ability to identify domain administrator accounts.
BlackCat can utilize net use commands to identify domain users.
BloodHound can collect information about domain users, including identification of domain admin accounts.
BoomBox has the ability to execute an LDAP query to enumerate the distinguished name, SAM account name, and display name for all domain users.
It has used net user /domain to identify account information.
Brute Ratel C4 can use LDAP queries, net group "Domain Admins" /domain and net user /domain for discovery.
It has has used net user /dom and net user Administrator to enumerate domain accounts including administrator accounts.
Cobalt Strike can determine if the user on an infected machine is in the admin or domain admin group.
CrackMapExec can enumerate the domain user accounts on a targeted system.
It has used batch scripts to enumerate users on a victim domain controller.
dsquery can be used to gather information on user accounts within a domain.
Empire can acquire local and domain user account information.
It can identify user accounts associated with a Service Principal Name and query Service Principal Names within the domain by utilizing the following scripts: GetUserSPNs.vbs and querySpn.vbs.
It has used Metasploit’s PsExec NTDSGRAB module to obtain a copy of the victim's Active Directory database.
It has used the Softerra LDAP browser to browse documentation on service accounts.
The IceApple Active Directory Querier module  can perform authenticated requests against an Active Directory server.
IcedID can query LDAP to identify additional users on the network to infect.
It performs account discovery using commands such as net localgroup administrators and net group "REDACTED" /domain on specific permissions groups.
It has used the AD Explorer tool to enumerate users on a victim's network.
It has used the Microsoft administration tool csvde.exe to export Active Directory data.
It has used cmd.exe net user /domain to enumerate domain users.
Net commands used with the /domain flag can be used to gather information about and manipulate user accounts on the current domain.
It has run net user, net user /domain, net group "domain admins" /domain, and net group "Exchange Trusted Subsystem" /domain to get account listings on a victim.
During Operation CuckooBees, the threat actors used the dsquery and dsget commands to get domain environment information and to query users in administrative groups.
During Operation Dream Job, It queried compromised victim's active directory servers to obtain the list of employees including administrator accounts.
During Operation Wocao, threat actors used the net command to retrieve information about domain accounts.
OSInfo enumerates local and domain users
It searches for administrator accounts on both the local victim machine and the network.
PoshC2 can enumerate local and domain user account information.
POWRUNER may collect user account information by running net user /domain or a series of other commands on a victim.
It has used a tool to query Active Directory using LDAP, discovering information about usernames listed in AD.
SILENTTRINITY can use System.Security.AccessControl namespaces to retrieve domain user information.
During the SolarWinds Compromise, It used PowerShell to discover domain accounts by exectuing Get-ADUser and Get-ADGroupMember.
SoreFang can enumerate domain accounts via net.exe user /domain.
Stuxnet enumerates user accounts of the domain.
Sykipot may use net group "domain admins" /domain to display accounts in the "domain admins" permissions group and net localgroup "administrators" to list local system administrator group membership.
It has used net user /domain to enumerate domain accounts.
Valak has the ability to enumerate domain admin accounts.
It has run net group /dom and net group "Domain Admins" /dom in compromised environments for account discovery.
It has identified domain admins through the use of net group "Domain admins" /DOMAIN. It has also leveraged the PowerShell cmdlet Get-ADComputer to collect account names from Active Directory data.