Account Discovery

What is Account Discovery?

“Account Discovery is documented as technique T1087 in MITRE ATT&CK® v19.1 under the Discovery tactic. Detection requires visibility into SIEM, XDR telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Account Discovery activity. These methods apply across SIEM, XDR environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor for execution of net user, net group, net localgroup, and whoami commands in quick succession, which is a common pattern during post-compromise reconnaissance regardless of the operator behind the attack.

2. 2

   Alert on LDAP queries for user account enumeration from workstations that would not normally perform such queries, particularly queries retrieving all user objects or filtering for accounts with specific attributes like AdminCount=1.

3. 3

   Detect BloodHound and similar AD enumeration tools through their characteristic LDAP query patterns, including queries for all objects with specific properties used to map attack paths through Active Directory.

4. 4

   Monitor for use of PowerShell cmdlets Get-ADUser, Get-ADGroup, and Get-ADGroupMember outside of established administrative scripts, particularly when executed with credentials other than the logged-in user.

5. 5

   Alert on /etc/passwd and /etc/shadow file access on Linux servers by non-root processes or from user accounts that have no administrative responsibilities on those specific systems.

Example Alerts

These realistic alert examples show what Account Discovery looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Account Discovery?

Detection centers on SIEM, XDR telemetry for the discovery phase of the attack. Monitor for execution of net user, net group, net localgroup, and whoami commands in quick succession, which is a common pattern during post-compromise reconnaissance regardless of the operator behind the attack. Alert on LDAP queries for user account enumeration from workstations that would not normally perform such queries, particularly queries retrieving all user objects or filtering for accounts with specific attributes like AdminCount=1.

What does a Account Discovery alert look like?

A representative SIEM detection is "Active Directory Enumeration via BloodHound" (high severity): LDAP query pattern analysis detected BloodHound data collection activity from workstation WS-SALES-022. Queries retrieved all user objects, group memberships, computer accounts, and GPO configurations within 8 minutes. This comprehensive Active Directory enumeration provides attackers with a complete map of attack paths to domain admin. The source workstation user has no administrative role.

Which tools detect Account Discovery, and how can I practice?

Account Discovery (T1087) is best surfaced with SIEM, XDR telemetry, which exposes the discovery signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.