Applied Cybernetics Group
T1087 Account Discovery
- Technique
T1087- Tactics
- Discovery
- Research, 90 days
- 4
- KEV CVEs mapped
- 6
- SigmaHQ rules
- 16
- Elastic, Splunk
- 42
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1087
MITRE description
Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., [Valid Accounts](https://attack.mitre.org/techniques/T1078)). Adversaries may use several methods to enumerate accounts, including abuse of existing tools, built-in commands, and potential misconfigurations that leak account names and roles or permissions in the targeted environment. For examples, cloud environments typically provide easily accessible interfaces to obtain user lists.(Citation: AWS List Users)(Citation: Google Cloud - IAM Servie Accounts List API) On hosts, adversaries can use default [PowerShell](https://attack.mitre.org/techniques/T1059/001) and other command line functionality to identify accounts. Information about email addresses and accounts may also be extracted by searching an infected system’s files.
KEV CVEs mapped to this technique
MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-10-29Cisco Talos: IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases -
2026-10-22Group-IB: Inside SiriusQT: A Seriously Skilled RAT -
2026-10-14Group-IB: KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize -
2026-08-12Huntress: Akira Hits Safe Mode: Ransomware Rebooting Around EDR
Detection coverage
SigmaHQ community rules
- Potential Pikabot Discovery Activity (emerging-threats)
- SharpHound Recon Account Discovery (core)
- Hacktool Ruler (core)
- Uncommon Connection to Active Directory Web Services (core)
- Malicious PowerShell Commandlets - PoshModule (core)
- Malicious PowerShell Commandlets - ScriptBlock (core)
- HackTool - SOAPHound Execution (core)
- HackTool - winPEAS Execution (core)
- Network Reconnaissance Activity (core)
- Malicious PowerShell Commandlets - ProcessCreation (core)
- PUA - Seatbelt Execution (core)
- Potentially Suspicious EventLog Recon Activity Using Log Query Utilities (core)
- Suspicious Use of PsLogList (core)
- Chopper Webshell Process Pattern (core)
- Webshell Hacking Activity Patterns (core)
- Webshell Detection With Command Line Keywords (core)
Elastic and Splunk rules
- Direct Interactive Kubernetes API Request by Unusual Utilities (elastic)
- Anthropic Organization Member and Group Enumeration (elastic)
- AWS IAM Principal Enumeration via UpdateAssumeRolePolicy (elastic)
- AWS Discovery API Calls via CLI from a Single Resource (elastic)
- AWS STS GetCallerIdentity API Called for the First Time (elastic)
- AWS EC2 Role GetCallerIdentity from New Source AS Organization (elastic)
- AWS Account Discovery By Rare User (elastic)
- AWS STS GetCallerIdentity Bulk Account Enumeration (elastic)
- Entra ID OAuth Device Code Sign-in to Azure AD Graph Enumeration (elastic)
- Entra ID ROPC Authentication with Unknown Client ID (elastic)
- Azure AD Graph High 4xx Error Ratio from User (elastic)
- Azure AD Graph Potential Enumeration (ROADrecon) (elastic)
- Azure AD Graph Access with Suspicious User-Agent (elastic)
- Azure AD Graph Access with Unusual Client and User (elastic)
- Entra ID Sign-in BloodHound Suite User-Agent Detected (elastic)
- Entra ID Sign-in TeamFiltration User-Agent Detected (elastic)
- Entra ID Managed Device Client Sign-In to Graph Enumeration (elastic)
- Microsoft Graph Multi-Category Reconnaissance Burst (elastic)
- Microsoft Graph Application Directory Reconnaissance with Denied Requests (elastic)
- ESXi System and Account Enumeration (elastic)
- Unusual User Privilege Enumeration via id (elastic)
- Potential Meterpreter Reverse Shell (elastic)
- Enumeration of Users or Groups via Built-in Commands (elastic)
- Potential Enumeration via Active Directory Web Service (elastic)
- Active Directory Discovery using AdExplorer (elastic)
Showing 25 of 42.