MITRE ATT&CK  /  T1087

T1087

Account Discovery

Description

Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., [Valid Accounts](https://attack.mitre.org/techniques/T1078)).Adversaries may use several methods to enumerate accounts, including abuse of existing tools, built-in commands, and potential misconfigurations that leak account names and roles or permissions in the targeted environment.For examples, cloud environments typically provide easily accessible interfaces to obtain user lists.(Citation: AWS List Users)(Citation: Google Cloud - IAM Servie Accounts List API) On hosts, adversaries can use default [PowerShell](https://attack.mitre.org/techniques/T1059/001) and other command line functionality to identify accounts. Information about email addresses and accounts may also be extracted by searching an infected system’s files.

Platforms

Mitigations

• M1028 — Operating System Configuration
• M1018 — User Account Management

Our coverage

• PCPJack Cloud Worm Evicts TeamPCP and Steals 40+ Credential Types at Scale
• UAT-8302 China APT Malware Analysis: Shared Implants, IOCs, and Detection Rules

Source: MITRE ATT&CK Enterprise matrix. View on attack.mitre.org →