Account Discovery

What is Account Discovery?

Adversaries may attempt to get a listing of local system or domain accounts. This information can help adversaries determine which accounts exist on a system so that compromised credentials can be matched to those accounts or so that new accounts can be created to blend in with the existing environment. On Windows, this includes commands like net user, net localgroup, and dsquery. On Linux, attackers enumerate users from /etc/passwd and using commands like id, who, and getent. Active Directory enumeration using LDAP queries, ADExplorer, BloodHound, and PowerView provides comprehensive maps of domain accounts, group memberships, and permissions that help attackers identify the most privileged accounts to target for credential theft or privilege escalation. Understanding the account landscape is a critical precursor to targeted lateral movement and privilege escalation attacks.

“Account Discovery is documented as technique T1087 in the MITRE ATT&CK knowledge base under the Discovery tactic. Detection requires visibility into SIEM, XDR telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Account Discovery activity. These methods apply across SIEM, XDR environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor for execution of net user, net group, net localgroup, and whoami commands in quick succession, which is a common pattern during post-compromise reconnaissance regardless of the operator behind the attack.

2. 2

   Alert on LDAP queries for user account enumeration from workstations that would not normally perform such queries, particularly queries retrieving all user objects or filtering for accounts with specific attributes like AdminCount=1.

3. 3

   Detect BloodHound and similar AD enumeration tools through their characteristic LDAP query patterns, including queries for all objects with specific properties used to map attack paths through Active Directory.

4. 4

   Monitor for use of PowerShell cmdlets Get-ADUser, Get-ADGroup, and Get-ADGroupMember outside of established administrative scripts, particularly when executed with credentials other than the logged-in user.

5. 5

   Alert on /etc/passwd and /etc/shadow file access on Linux servers by non-root processes or from user accounts that have no administrative responsibilities on those specific systems.

Example Alerts

These realistic alert examples show what Account Discovery looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Account Discovery?

SOC analysts detect Account Discovery (T1087) by monitoring SIEM, XDR telemetry for behavioral anomalies and specific indicators. Key detection methods include monitor for execution of net user, net group, net localgroup, and whoami commands in quick succession, which is a common pattern during post-compromis. SOCSimulator provides hands-on practice detecting this technique with realistic alerts.

What security tools are used to detect Account Discovery?

Account Discovery can be detected using SIEM, XDR platforms. SIEM tools are particularly effective for this technique because they provide visibility into the discovery phase of the attack chain. SOCSimulator simulates all three tool types for hands-on training.

How common is Account Discovery in real-world attacks?

Account Discovery is a well-documented MITRE ATT&CK technique in the Discovery tactic. It appears in threat intelligence reports from multiple security vendors and has been observed in campaigns by various threat actor groups. SOCSimulator includes realistic Account Discovery scenarios based on documented attack patterns, helping analysts build detection intuition.

Can I practice detecting Account Discovery for free?

Yes. SOCSimulator offers free forever access to training scenarios, including Discovery techniques like Account Discovery. You can investigate realistic alerts in guided Operations rooms, build detection skills with SIEM, XDR, and Firewall interfaces, and test yourself under pressure in Shift Mode. No credit card required.