{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1087","id":"T1087","name":"Account Discovery","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1087","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"7e966b114f1c1135088d4ca6d41e15ed09d704c8c2418b52a2daed3542c23ae5","description":"Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., [Valid Accounts](https://attack.mitre.org/techniques/T1078)).\n\nAdversaries may use several methods to enumerate accounts, including abuse of existing tools, built-in commands, and potential misconfigurations that leak account names and roles or permissions in the targeted environment.\n\nFor examples, cloud environments typically provide easily accessible interfaces to obtain user lists.(Citation: AWS List Users)(Citation: Google Cloud - IAM Servie Accounts List API) On hosts, adversaries can use default [PowerShell](https://attack.mitre.org/techniques/T1059/001) and other command line functionality to identify accounts. Information about email addresses and accounts may also be extracted by searching an infected system’s files.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1087","external_id":"T1087"},{"source_name":"AWS List Users","description":"Amazon. (n.d.). List Users. Retrieved August 11, 2020.","url":"https://docs.aws.amazon.com/cli/latest/reference/iam/list-users.html"},{"source_name":"Google Cloud - IAM Servie Accounts List API","description":"Google. (2020, June 23). gcloud iam service-accounts list. Retrieved August 4, 2020.","url":"https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/list"},{"source_name":"Elastic - Koadiac Detection with EQL","description":"Stepanic, D.. (2020, January 13). Embracing offensive tooling: Building detections against Koadic using EQL. Retrieved November 17, 2024.","url":"https://www.elastic.co/security-labs/embracing-offensive-tooling-building-detections-against-koadic-using-eql"}],"platforms":["ESXi","IaaS","Identity Provider","Linux","macOS","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","identity","onprem","saas","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1087.001","id":"T1087.001","name":"Local Account","page":"techniques/enterprise/T1087.001/"},{"key":"enterprise/T1087.002","id":"T1087.002","name":"Domain Account","page":"techniques/enterprise/T1087.002/"},{"key":"enterprise/T1087.003","id":"T1087.003","name":"Email Account","page":"techniques/enterprise/T1087.003/"},{"key":"enterprise/T1087.004","id":"T1087.004","name":"Cloud Account","page":"techniques/enterprise/T1087.004/"}],"telemetry":[{"id":"DC0083","name":"Cloud Service Enumeration","page":"telemetry/DC0083/","kind":"attack_component","category":"Cloud control plane","description":"Enumeration of available cloud services or their configuration.","collection_focus":"Collect supported list/describe administrative APIs and retain caller and queried service scope; confirm read-event retention.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["actor","service","action","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0083","collector":"illustrative-lab-collector","observation":{"actor":"lab-reader","service":"lab-monitoring","action":"list_resources","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."},{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0055","name":"File Access","page":"telemetry/DC0055/","kind":"attack_component","category":"Windows and directory audit","description":"Access to file objects with user, process and access-right context.","collection_focus":"Enable Audit File System plus a narrow SACL on a lab directory; on Linux select path/syscall rules and join associated Audit records.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["path","access","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0099","name":"Group Enumeration","page":"telemetry/DC0099/","kind":"attack_component","category":"Windows and directory audit","description":"Requests to list groups or their members.","collection_focus":"Collect supported group enumeration audit or directory-query telemetry, and correlate with process/API records. Group-management change logs alone do not prove read access.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"},{"name":"Active Directory domain controllers","scope":"Directory changes and authentication records; collect from the relevant controllers, not only endpoints.","source_id":"ad"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["actor","group","action","result_count"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0099","collector":"illustrative-lab-collector","observation":{"actor":"LAB\\analyst","group":"LabReaders","action":"list_members","result_count":2}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0029","name":"Script Execution","page":"telemetry/DC0029/","kind":"attack_component","category":"Script and command execution","description":"Script content or script execution observations from an interpreter-aware sensor.","collection_focus":"Collect PowerShell 4104 with script-block ID and fragment sequence; instrument other engines separately rather than assigning them the same event ID.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":{"label":"Read recent Windows PowerShell script-block events","language":"powershell","source_id":"powershell","content":"Get-WinEvent -FilterHashtable @{\n  LogName = 'Microsoft-Windows-PowerShell/Operational'\n  Id = 4104\n} -MaxEvents 5","note":"Read-only check after Script Block Logging is configured. For PowerShell 7 use its registered PowerShellCore/Operational channel. Missing events are not proof of no execution; check policy, channel and permissions."},"required_fields":["engine","script_block_id","fragment","fragments_total","script_text"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0029","collector":"illustrative-lab-collector","observation":{"engine":"PowerShell","script_block_id":"lab-script-1","fragment":1,"fragments_total":1,"script_text":"Write-Output \"LAB_TELEMETRY_CHECK\""}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0013","name":"User Account Metadata","page":"telemetry/DC0013/","kind":"attack_component","category":"Host state and inventory","description":"Account inventory and attributes at a point in time.","collection_focus":"Export an authorized directory/account inventory with stable IDs, roles, enabled state and collection time; compare snapshots without exposing credentials.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["account_id","enabled","roles","inventory_time"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0013","collector":"illustrative-lab-collector","observation":{"account_id":"user-lab-1","enabled":true,"roles":["lab-reader"],"inventory_time":"2026-09-27T12:00:00Z"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."}],"detection":{"key":"enterprise/T1087","id":"T1087","name":"Account Discovery","domain":"enterprise","platforms":["ESXi","IaaS","Identity Provider","Linux","macOS","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","identity","onprem","saas","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1087","technique_page":"techniques/enterprise/T1087/","page":"detections/enterprise/T1087/","status":"rule_source_available","counts":{"sigma":15,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":8,"live_validated":0},"sigma_rules":[{"id":"65f77b1e-8e79-45bf-bb67-5988a8ce45a5","title":"SharpHound Recon Account Discovery","status":"test","level":"high","logsource":{"product":"rpc_firewall","category":"application","definition":"Requirements: install and apply the RPC Firewall to all processes with \"audit:true action:block uuid:6bffd098-a112-3610-9833-46c3f87e345a opnum:2"},"data_path":"data/detection-rules/65f77b1e-8e79-45bf-bb67-5988a8ce45a5.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/rpc_firewall/rpc_firewall_sharphound_recon_account.yml","author":"Sagie Dulce, Dekel Paz","kind":"sigma"},{"id":"24549159-ac1b-479c-8175-d42aea947cae","title":"Hacktool Ruler","status":"test","level":"high","logsource":{"product":"windows","service":"security"},"data_path":"data/detection-rules/24549159-ac1b-479c-8175-d42aea947cae.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_alert_ruler.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"b3ad3c0f-c949-47a1-a30e-b0491ccae876","title":"Uncommon Connection to Active Directory Web Services","status":"test","level":"medium","logsource":{"category":"network_connection","product":"windows"},"data_path":"data/detection-rules/b3ad3c0f-c949-47a1-a30e-b0491ccae876.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/network_connection/net_connection_win_adws_unusual_connection.yml","author":"@kostastsale","kind":"sigma"},{"id":"7d0d0329-0ef1-4e84-a9f5-49500f9d7c6c","title":"Malicious PowerShell Commandlets - PoshModule","status":"test","level":"high","logsource":{"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"},"data_path":"data/detection-rules/7d0d0329-0ef1-4e84-a9f5-49500f9d7c6c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_module/posh_pm_malicious_commandlets.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"89819aa4-bbd6-46bc-88ec-c7f7fe30efa6","title":"Malicious PowerShell Commandlets - ScriptBlock","status":"test","level":"high","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/89819aa4-bbd6-46bc-88ec-c7f7fe30efa6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_malicious_commandlets.yml","author":"Sean Metcalf, Florian Roth, Bartlomiej Czyz @bczyz1, oscd.community, Nasreddine Bencherchali, Tim Shelton, Mustafa Kaan Demir, Georg Lauenstein, Max Altgelt, Tobias Michalski, Austin Songer","kind":"sigma"},{"id":"e92a4287-e072-4a40-9739-370c106bb750","title":"HackTool - SOAPHound Execution","status":"test","level":"high","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/e92a4287-e072-4a40-9739-370c106bb750.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_soaphound_execution.yml","author":"@kostastsale","kind":"sigma"},{"id":"98b53e78-ebaf-46f8-be06-421aafd176d9","title":"HackTool - winPEAS Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/98b53e78-ebaf-46f8-be06-421aafd176d9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_winpeas.yml","author":"Georg Lauenstein (sure[secure])","kind":"sigma"},{"id":"e6313acd-208c-44fc-a0ff-db85d572e90e","title":"Network Reconnaissance Activity","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/e6313acd-208c-44fc-a0ff-db85d572e90e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_nslookup_domain_discovery.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"02030f2f-6199-49ec-b258-ea71b07e03dc","title":"Malicious PowerShell Commandlets - ProcessCreation","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/02030f2f-6199-49ec-b258-ea71b07e03dc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_malicious_cmdlets.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"38646daa-e78f-4ace-9de0-55547b2d30da","title":"PUA - Seatbelt Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/38646daa-e78f-4ace-9de0-55547b2d30da.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_seatbelt.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"beaa66d6-aa1b-4e3c-80f5-e0145369bfaf","title":"Potentially Suspicious EventLog Recon Activity Using Log Query Utilities","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/beaa66d6-aa1b-4e3c-80f5-e0145369bfaf.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_eventlog_content_recon.yml","author":"Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)","kind":"sigma"},{"id":"aae1243f-d8af-40d8-ab20-33fc6d0c55bc","title":"Suspicious Use of PsLogList","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/aae1243f-d8af-40d8-ab20-33fc6d0c55bc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_sysinternals_psloglist.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"fa3c117a-bc0d-416e-a31b-0c0e80653efb","title":"Chopper Webshell Process Pattern","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/fa3c117a-bc0d-416e-a31b-0c0e80653efb.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_webshell_chopper.yml","author":"Florian Roth (Nextron Systems), MSTI (query)","kind":"sigma"},{"id":"4ebc877f-4612-45cb-b3a5-8e3834db36c9","title":"Webshell Hacking Activity Patterns","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/4ebc877f-4612-45cb-b3a5-8e3834db36c9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_webshell_hacking.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"bed2a484-9348-4143-8a8a-b801c979301c","title":"Webshell Detection With Command Line Keywords","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/bed2a484-9348-4143-8a8a-b801c979301c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_webshell_recon_commands_and_processes.yml","author":"Florian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1087-1","technique_id":"T1087","title":"T1087 Account Discovery","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#discovery","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":127,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L127","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"39ad38f671070c303d790a331a8f1ff893f80889f08babe91358f2b7df024573","validation":"published_concept_not_executable_or_live_validated","logic":"MATCH(process_or_api_operation IN account_enumeration_operations) AND actor NOT_IN approved_admin_tools -> ALERT","log_sources":[{"title":"Process Execution Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#6-process-execution-logs"},{"title":"Directory-Service Audit Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#42-directory-service-audit-logs"},{"title":"Cloud Identity and Access Management Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#105-cloud-identity-and-access-management-logs"}]}],"atlas_anomaly":[{"id":"atlas-anomaly-t1087-1","technique_id":"T1087","title":"Accounts, groups, roles, or permissions enumerated — T1087 Account Discovery","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#account-enumeration","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":88,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L88","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"9d0ac14787b1130bea647c0916cf4079fb96912446114508aaaec1bee6a02b04","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"actor and directory-object access stream.","expected_behavior":"ordinary identities query a narrow object subset.","deviation":"broad object fan-out, burst, or peer-group deviation.","anomaly_types":[{"title":"Fan-Out Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#78-fan-out-anomaly"},{"title":"Volume Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#15-volume-anomaly"},{"title":"Peer-Group Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#8-peer-group-anomaly"}],"log_sources":[{"title":"Directory-Service Audit Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#42-directory-service-audit-logs"},{"title":"Cloud Identity and Access Management Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#105-cloud-identity-and-access-management-logs"}],"context_references":[{"title":"Volt Typhoon joint advisory — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/fbi-aa24-038a-volt-typhoon.pdf"},{"title":"original source","url":"https://www.fbi.gov/file-repository/cyber-alerts/prc-state-sponsored-actors-compromise-and-maintain-persistent-access-to-u-s-critical-infrastructure.pdf"}]}],"anomaly_types":[{"title":"Fan-Out Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#78-fan-out-anomaly"},{"title":"Peer-Group Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#8-peer-group-anomaly"},{"title":"Volume Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#15-volume-anomaly"}],"strategies":[{"id":"DET0587","name":"Enumeration of User or Account Information Across Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0587","stix_id":"x-mitre-detection-strategy--fdda430c-e4f6-43ce-95d6-0f97253ff6a2","relationship_id":"relationship--6977ce04-33d6-4080-8e9c-ac61a4a48dfa","description":"","analytics":[{"id":"AN1612","name":"Analytic 1612","guidance":"Detection of processes performing local or domain account enumeration by invoking account directory queries or security APIs followed by structured output of account lists. The defender observes command execution or API invocation patterns that retrieve account information and produce enumeration artifacts shortly afterward.","url":"https://attack.mitre.org/detectionstrategies/DET0587#AN1612","platforms":["Windows"],"tuning":[{"field":"CommandLinePattern","description":"Match variations in enumeration commands like 'net user', 'Get-ADUser', 'dsquery'."},{"field":"TimeWindow","description":"Short burst of account enumeration commands may indicate automation."},{"field":"UserContext","description":"Restrict to non-admin accounts or unexpected users executing enumeration commands."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN1612","source_url":"https://attack.mitre.org/detectionstrategies/DET0587#AN1612","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Security","channel":"EventCode=4688","platforms":["Windows"],"analytic_id":"AN1612","source_url":"https://attack.mitre.org/detectionstrategies/DET0587#AN1612","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0099","component":"Group Enumeration","name":"WinEventLog:Security","channel":"EventCode=4798, 4799","platforms":["Windows"],"analytic_id":"AN1612","source_url":"https://attack.mitre.org/detectionstrategies/DET0587#AN1612","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0099/"}]},{"id":"AN1613","name":"Analytic 1613","guidance":"Enumeration of users and groups through suspicious shell commands or unauthorized access to /etc/passwd or /etc/shadow.","url":"https://attack.mitre.org/detectionstrategies/DET0587#AN1613","platforms":["Linux"],"tuning":[{"field":"AccessedFile","description":"Tune based on file paths such as '/etc/passwd', '/etc/group', '/etc/shadow'."},{"field":"ParentProcessName","description":"Filter known admin processes to reduce false positives."}],"log_sources":[{"component_id":"DC0055","component":"File Access","name":"auditd:SYSCALL","channel":"PATH","platforms":["Linux"],"analytic_id":"AN1613","source_url":"https://attack.mitre.org/detectionstrategies/DET0587#AN1613","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"},{"component_id":"DC0032","component":"Process Creation","name":"linux:Sysmon","channel":"EventCode=1","platforms":["Linux"],"analytic_id":"AN1613","source_url":"https://attack.mitre.org/detectionstrategies/DET0587#AN1613","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN1614","name":"Analytic 1614","guidance":"Detection of account enumeration through directory service queries or system utilities accessing account metadata stores, followed by structured enumeration output.","url":"https://attack.mitre.org/detectionstrategies/DET0587#AN1614","platforms":["macOS"],"tuning":[{"field":"CommandLine","description":"Tune for dscl -list, dscacheutil -q user, id -un, etc."},{"field":"ExecutionContext","description":"Alert if enumeration is performed in non-console session or by unusual users."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"process event","platforms":["macOS"],"analytic_id":"AN1614","source_url":"https://attack.mitre.org/detectionstrategies/DET0587#AN1614","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0013","component":"User Account Metadata","name":"macos:unifiedlog","channel":"DirectoryService queries retrieving account information","platforms":["macOS"],"analytic_id":"AN1614","source_url":"https://attack.mitre.org/detectionstrategies/DET0587#AN1614","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0013/"}]},{"id":"AN1615","name":"Analytic 1615","guidance":"Detection of enumeration of identity entities through cloud provider APIs where principals retrieve account metadata such as IAM users or roles in rapid succession.","url":"https://attack.mitre.org/detectionstrategies/DET0587#AN1615","platforms":["IaaS"],"tuning":[{"field":"API_Method","description":"Tune based on which IAM APIs are used and their frequency."},{"field":"CallerType","description":"Differentiate user-initiated from automated/scripted enumeration."}],"log_sources":[{"component_id":"DC0083","component":"Cloud Service Enumeration","name":"AWS:CloudTrail","channel":"DescribeUsers / ListUsers / GetUser","platforms":["IaaS"],"analytic_id":"AN1615","source_url":"https://attack.mitre.org/detectionstrategies/DET0587#AN1615","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0083/"}]},{"id":"AN1616","name":"Analytic 1616","guidance":"Detection of identity directory enumeration through API calls or administrative queries retrieving multiple account objects within a short interval.","url":"https://attack.mitre.org/detectionstrategies/DET0587#AN1616","platforms":["Identity Provider"],"tuning":[{"field":"QueryType","description":"Detect user vs role enumeration. Tune based on query scope."},{"field":"AppContext","description":"Correlate enumeration with unexpected app registrations or identities."}],"log_sources":[{"component_id":"DC0083","component":"Cloud Service Enumeration","name":"azure:signinlogs","channel":"Graph API Query","platforms":["Identity Provider"],"analytic_id":"AN1616","source_url":"https://attack.mitre.org/detectionstrategies/DET0587#AN1616","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0083/"},{"component_id":"DC0013","component":"User Account Metadata","name":"saas:okta","channel":"User Enumeration Events","platforms":["Identity Provider"],"analytic_id":"AN1616","source_url":"https://attack.mitre.org/detectionstrategies/DET0587#AN1616","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0013/"}]},{"id":"AN1617","name":"Analytic 1617","guidance":"Detection of enumeration activity when system processes query ESXi host account configuration or management APIs to retrieve user account listings.","url":"https://attack.mitre.org/detectionstrategies/DET0587#AN1617","platforms":["ESXi"],"tuning":[{"field":"CommandPattern","description":"Tune based on known enumeration commands: 'vim-cmd vimsvc/auth/userlist'."},{"field":"PrivilegedSession","description":"Elevated enumeration from vpxuser or root may indicate threat activity."}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"esxi:vpxd","channel":"vCenter Management","platforms":["ESXi"],"analytic_id":"AN1617","source_url":"https://attack.mitre.org/detectionstrategies/DET0587#AN1617","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]},{"id":"AN1618","name":"Analytic 1618","guidance":"Account enumeration via bulk access to user directory features or hidden APIs.","url":"https://attack.mitre.org/detectionstrategies/DET0587#AN1618","platforms":["SaaS"],"tuning":[{"field":"EndpointURL","description":"Tune based on enumeration from directory endpoints such as /users, /groups."},{"field":"UserAgent","description":"Detect scripted enumeration via curl/wget or unknown tools."}],"log_sources":[{"component_id":"DC0013","component":"User Account Metadata","name":"gcp:audit","channel":"Directory API Access","platforms":["SaaS"],"analytic_id":"AN1618","source_url":"https://attack.mitre.org/detectionstrategies/DET0587#AN1618","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0013/"}]},{"id":"AN1619","name":"Analytic 1619","guidance":"Account discovery via VBA macros, COM objects, or embedded scripting.","url":"https://attack.mitre.org/detectionstrategies/DET0587#AN1619","platforms":["Office Suite"],"tuning":[{"field":"MacroName","description":"Alert on auto-running macros accessing directory or user info."},{"field":"ExecutionScope","description":"Focus on macros invoking LDAP, ADODB, or WMI queries."}],"log_sources":[{"component_id":"DC0029","component":"Script Execution","name":"m365:unified","channel":"Scripted Activity","platforms":["Office Suite"],"analytic_id":"AN1619","source_url":"https://attack.mitre.org/detectionstrategies/DET0587#AN1619","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0029/"}]}]}],"telemetry_references":[{"id":"DC0083","name":"Cloud Service Enumeration","tag":"Cloud Service Enumeration","page":"telemetry/DC0083/","kind":"attack_component"},{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0055","name":"File Access","tag":"File Access","page":"telemetry/DC0055/","kind":"attack_component"},{"id":"DC0099","name":"Group Enumeration","tag":"Group Enumeration","page":"telemetry/DC0099/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0029","name":"Script Execution","tag":"Script Execution","page":"telemetry/DC0029/","kind":"attack_component"},{"id":"DC0013","name":"User Account Metadata","tag":"User Account Metadata","page":"telemetry/DC0013/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0445","name":"ShimRatReporter","page":"tools/S0445/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0445","name":"ShimRatReporter","page":"tools/S0445/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0445","name":"ShimRatReporter","url":"https://attack.mitre.org/software/S0445","kind":"tool","description":"[ShimRatReporter](https://attack.mitre.org/software/S0445) listed all non-privileged and privileged accounts available on the machine.(Citation: FOX-IT May 2016 Mofang)","relationship_id":"relationship--52741f41-28c6-4533-bd26-6dc21f6b0794","references":[{"source_name":"FOX-IT May 2016 Mofang","description":"Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.","url":"https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"}]},{"id":"S0658","name":"XCSSET","url":"https://attack.mitre.org/software/S0658","kind":"malware","description":"[XCSSET](https://attack.mitre.org/software/S0658) attempts to discover accounts from various locations such as a user's Evernote, AppleID, Telegram, Skype, and WeChat data.(Citation: trendmicro xcsset xcode project 2020)","relationship_id":"relationship--e481bd6a-3143-4fd6-b1d9-97d1060f423d","references":[{"source_name":"trendmicro xcsset xcode project 2020","description":"Mac Threat Response, Mobile Research Team. (2020, August 13). The XCSSET Malware: Inserts Malicious Code Into Xcode Projects, Performs UXSS Backdoor Planting in Safari, and Leverages Two Zero-day Exploits. Retrieved October 5, 2021.","url":"https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf"}]},{"id":"S1065","name":"Woody RAT","url":"https://attack.mitre.org/software/S1065","kind":"malware","description":"[Woody RAT](https://attack.mitre.org/software/S1065) can identify administrator accounts on an infected machine.(Citation: MalwareBytes WoodyRAT Aug 2022)","relationship_id":"relationship--642039f8-984e-432d-a6a3-bc6b4469bba0","references":[{"source_name":"MalwareBytes WoodyRAT Aug 2022","description":"MalwareBytes Threat Intelligence Team. (2022, August 3). Woody RAT: A new feature-rich malware spotted in the wild. Retrieved December 6, 2022.","url":"https://www.malwarebytes.com/blog/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild"}]},{"id":"S1229","name":"Havoc","url":"https://attack.mitre.org/software/S1229","kind":"malware","description":"[Havoc](https://attack.mitre.org/software/S1229) can identify privileged user accounts on infected systems.(Citation: Fortinet Havoc MAR 2025)\n","relationship_id":"relationship--8ceb3eaa-24bd-4418-851c-2af2fb3d56d8","references":[{"source_name":"Fortinet Havoc MAR 2025","description":"Wan, Y. (2025, March 3). Havoc: SharePoint with Microsoft Graph API turns into FUD C2. Retrieved August 4, 2025.","url":"https://www.fortinet.com/blog/threat-research/havoc-sharepoint-with-microsoft-graph-api-turns-into-fud-c2"}]},{"id":"S1239","name":"TONESHELL","url":"https://attack.mitre.org/software/S1239","kind":"malware","description":"[TONESHELL](https://attack.mitre.org/software/S1239) included functionality to retrieve a list of user accounts.(Citation: Zscaler)","relationship_id":"relationship--ccf0d066-a71c-4a8b-b16c-4ddcc8eca267","references":[{"source_name":"Zscaler","description":"Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"}]}],"actors":[{"id":"G0143","name":"Aquatic Panda","url":"https://attack.mitre.org/groups/G0143","kind":"intrusion-set","description":"[Aquatic Panda](https://attack.mitre.org/groups/G0143) used the <code>last</code> command in Linux environments to identify recently logged-in users on victim machines.(Citation: Crowdstrike HuntReport 2022)","relationship_id":"relationship--02b38264-044a-47ee-b8d8-a08cbb115d06","references":[{"source_name":"Crowdstrike HuntReport 2022","description":"CrowdStrike. (2023). 2022 Falcon OverWatch Threat Hunting Report. Retrieved May 20, 2024.","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf"}]},{"id":"G1015","name":"Scattered Spider","url":"https://attack.mitre.org/groups/G1015","kind":"intrusion-set","description":"[Scattered Spider](https://attack.mitre.org/groups/G1015) has identified vSphere administrator accounts.(Citation: Mandiant VMware vSphere JUL 2025)\n","relationship_id":"relationship--2655a359-4baf-4fa0-9f1d-a1f1cf178da1","references":[{"source_name":"Mandiant VMware vSphere JUL 2025","description":"Mandiant Incident Response. (2025, July 23). From Help Desk to Hypervisor: Defending Your VMware vSphere Estate from UNC3944. Retrieved October 13, 2025.","url":"https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944"}]},{"id":"G1016","name":"FIN13","url":"https://attack.mitre.org/groups/G1016","kind":"intrusion-set","description":"[FIN13](https://attack.mitre.org/groups/G1016) has enumerated all users and their roles from a victim's main treasury system.(Citation: Mandiant FIN13 Aug 2022)","relationship_id":"relationship--ff16c592-9eae-4c27-97a5-444e148883cd","references":[{"source_name":"Mandiant FIN13 Aug 2022","description":"Ta, V., et al. (2022, August 8). FIN13: A Cybercriminal Threat Actor Focused on Mexico. Retrieved February 9, 2023.","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]}],"mitigations":[{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"Manage the creation, modification, use, and permissions associated to user accounts.","relationship_id":"relationship--bb59d6b5-a6a8-4071-b0a7-297593fc078b","references":[]},{"id":"M1028","name":"Operating System Configuration","url":"https://attack.mitre.org/mitigations/M1028","kind":"course-of-action","description":"Prevent administrator accounts from being enumerated when an application is elevating through UAC since it can lead to the disclosure of account names. The Registry key is located <code>HKLM\\ SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\CredUI\\EnumerateAdministrators</code>. It can be disabled through GPO: Computer Configuration > [Policies] > Administrative Templates > Windows Components > Credential User Interface: E numerate administrator accounts on elevation. (Citation: UCF STIG Elevation Account Enumeration)","relationship_id":"relationship--620d641c-8f76-45f3-a86f-03dd28399d5c","references":[{"source_name":"UCF STIG Elevation Account Enumeration","description":"UCF. (n.d.). The system must require username and password to elevate a running application.. Retrieved December 18, 2017.","url":"https://www.stigviewer.com/stig/microsoft_windows_server_2012_member_server/2013-07-25/finding/WN12-CC-000077"}]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1078":"/ttp-simulation/techniques/enterprise/T1078/","T1059.001":"/ttp-simulation/techniques/enterprise/T1059.001/","T1087":"/ttp-simulation/techniques/enterprise/T1087/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1087","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0083","collector":"illustrative-lab-collector","observation":{"actor":"lab-reader","service":"lab-monitoring","action":"list_resources","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0099","collector":"illustrative-lab-collector","observation":{"actor":"LAB\\analyst","group":"LabReaders","action":"list_members","result_count":2}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0029","collector":"illustrative-lab-collector","observation":{"engine":"PowerShell","script_block_id":"lab-script-1","fragment":1,"fragments_total":1,"script_text":"Write-Output \"LAB_TELEMETRY_CHECK\""}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0013","collector":"illustrative-lab-collector","observation":{"account_id":"user-lab-1","enabled":true,"roles":["lab-reader"],"inventory_time":"2026-09-27T12:00:00Z"}}]}}