T1087.002 — Domain Account

Tactic: Discovery · Platforms: Linux, macOS, Windows

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges. Commands such as net user /domain and net group /domain of…

Sub-technique of Account Discovery (T1087).

Sigma detection rules (3)

T1087.002 Account Discovery: Domain Account

title: "T1087.002 Account Discovery: Domain Account"
id: bad9b616-49a5-4668-a3b1-e8df839ec6a7
description: 'Domain Account Enumeration Across Platforms. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: CommandLinePattern, TimeWindow, SourceHost.'
references:
  - https://attack.mitre.org/techniques/T1087/002
author: Shahrukh Khan
date: 2026-01-25
license: MIT
tags:
  - attack.discovery
  - attack.t1087.002

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
    CommandLine|contains|all:
      - 'user'
      - '/domain'

  condition: selection

falsepositives:
  - Routine domain-account enumeration by IT/helpdesk tooling and login scripts.

level: informational

T1087.002 Account Discovery: Domain Account

title: "T1087.002 Account Discovery: Domain Account"
id: bcaea986-6f99-45ff-af9a-cc90410454c8
description: 'Domain Account Enumeration Across Platforms. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ProcessName, LDAPSearchFilter, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1087/002
author: Shahrukh Khan
date: 2026-01-23
license: MIT
tags:
  - attack.discovery
  - attack.t1087.002

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/ldapsearch'
      - '/wbinfo'
    a1|contains:
      - '-u'
      - 'sAMAccountName'

  condition: selection

falsepositives:
  - Domain account enumeration via ldapsearch/wbinfo is common in identity-sync and helpdesk tooling; volume-based tuning is needed to separate recon from routine lookups.

level: low

T1087.002 Account Discovery: Domain Account

title: "T1087.002 Account Discovery: Domain Account"
id: feeb1523-0dc6-49fb-ba99-4adbd9ee9045
description: 'Domain Account Enumeration Across Platforms. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CommandPattern, EndpointRole.'
references:
  - https://attack.mitre.org/techniques/T1087/002
author: Shahrukh Khan
date: 2026-03-30
license: MIT
tags:
  - attack.discovery
  - attack.t1087.002

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/dscl'
    CommandLine|contains: '/Active Directory/'

  condition: selection

falsepositives:
  - Directory-bound endpoint management tools query Active Directory accounts routinely.

level: low

Related sub-techniques

Explore