T1087.002Discovery

Domain Account

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges. Commands such as net user /domain and net group /domain of the Net utility, dscacheutil -q group on macOS, and ldapsearch on Linux can list domain users and…

attack.mitre.org ↗

CVEs5

In 5

Reports0

Detections

21 Sigma rules tagged T1087.002

Domain AccountT1087.00221 general rules

AD Privileged Users or Groups Reconnaissancehightest
BloodHound Collection Fileshightest
HackTool - Bloodhound/Sharphound Executionhightest
Malicious PowerShell Commandlets - PoshModulehightest
Malicious PowerShell Commandlets - ProcessCreationhightest
Malicious PowerShell Commandlets - ScriptBlockhightest
PUA - AdFind Suspicious Executionhightest
PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXEhightest

All 21 on SigmaHQ ↗

CVEs linked to Domain Account

5 CVEs, by priority. Each link shows its badge.

CVE-2023-3519Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
Citrix · NetScaler ADC and NetScaler GatewayKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1574Hijack Execution Flow+2 more · 6 reports
MITRE CTID mapping of the KEV entry · follow-on activity
99.7%Top 0.05%
89.9priority
CVE-2020-1472Microsoft Netlogon Privilege Escalation Vulnerability
Microsoft · NetlogonKEVRansomwarePublic exploitMedium · 5.5T1133External Remote Services T1068Exploitation for Privilege Escalation+4 more · 8 reports
MITRE CTID mapping of the KEV entry · primary impact
99.4%Top 0.06%
86.8priority
CVE-2021-40539Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability
Zoho · ManageEngineKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1047Windows Management Instrumentation+11 more · 1 report
MITRE CTID mapping of the KEV entry · follow-on activity
99.0%Top 0.07%
83.7priority
CVE-2023-32315Ignite Realtime Openfire Path Traversal Vulnerability
Ignite Realtime · OpenfireKEVPublic exploitHigh · 7.5T1505.003Web Shell T1202Indirect Command Execution+2 more · 1 report
MITRE CTID mapping of the KEV entry · follow-on activity
>99.9%Top 0.01%
82.1priority
CVE-2021-44077Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability
Zoho · ManageEngine ServiceDesk Plus (SDP) / SupportCenter PlusKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1047Windows Management Instrumentation+11 more
MITRE CTID mapping of the KEV entry · follow-on activity
93.3%Top 0.16%
69.8priority