T1087 Account Discovery — Detection Rules

Source-backed rule directory

• SharpHound Recon Account Discovery · test · high · {"product":"rpc_firewall","category":"application","definition":"Requirements: install and apply the RPC Firewall to all processes with \"audit:true action:block uuid:6bffd098-a112-3610-9833-46c3f87e345a opnum:2"}
• Hacktool Ruler · test · high · {"product":"windows","service":"security"}
• Uncommon Connection to Active Directory Web Services · test · medium · {"category":"network_connection","product":"windows"}
• Malicious PowerShell Commandlets - PoshModule · test · high · {"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"}
• Malicious PowerShell Commandlets - ScriptBlock · test · high · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
• HackTool - SOAPHound Execution · test · high · {"product":"windows","category":"process_creation"}
• HackTool - winPEAS Execution · test · high · {"category":"process_creation","product":"windows"}
• Network Reconnaissance Activity · test · high · {"category":"process_creation","product":"windows"}
• Malicious PowerShell Commandlets - ProcessCreation · test · high · {"category":"process_creation","product":"windows"}
• PUA - Seatbelt Execution · test · high · {"category":"process_creation","product":"windows"}
• Potentially Suspicious EventLog Recon Activity Using Log Query Utilities · test · medium · {"category":"process_creation","product":"windows"}
• Suspicious Use of PsLogList · test · medium · {"category":"process_creation","product":"windows"}
• Chopper Webshell Process Pattern · test · high · {"category":"process_creation","product":"windows"}
• Webshell Hacking Activity Patterns · test · high · {"category":"process_creation","product":"windows"}
• Webshell Detection With Command Line Keywords · test · high · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

T1087 Account Discovery

MATCH(process_or_api_operation IN account_enumeration_operations) AND actor NOT_IN approved_admin_tools -> ALERT

• Process Execution Logs
• Directory-Service Audit Logs
• Cloud Identity and Access Management Logs
• Atlas source section

Anomaly models

ATT&CK analytic guidance

DET0587 Enumeration of User or Account Information Across Platforms

AN1612 Analytic 1612

Detection of processes performing local or domain account enumeration by invoking account directory queries or security APIs followed by structured output of account lists. The defender observes command execution or API invocation patterns that retrieve account information and produce enumeration artifacts shortly afterward.

AN1613 Analytic 1613

Enumeration of users and groups through suspicious shell commands or unauthorized access to /etc/passwd or /etc/shadow.

AN1614 Analytic 1614

Detection of account enumeration through directory service queries or system utilities accessing account metadata stores, followed by structured enumeration output.

AN1615 Analytic 1615

Detection of enumeration of identity entities through cloud provider APIs where principals retrieve account metadata such as IAM users or roles in rapid succession.

AN1616 Analytic 1616

Detection of identity directory enumeration through API calls or administrative queries retrieving multiple account objects within a short interval.

AN1617 Analytic 1617

Detection of enumeration activity when system processes query ESXi host account configuration or management APIs to retrieve user account listings.

AN1618 Analytic 1618

Account enumeration via bulk access to user directory features or hidden APIs.

AN1619 Analytic 1619

Account discovery via VBA macros, COM objects, or embedded scripting.