29
Groups Using This
1
Tactics
3
Platforms
39
Prevalence Rank
Description

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges. Commands such as net user /domain and net group /domain of the Net utility, dscacheutil -q group on macOS, and ldapsearch on Linux can list domain users and groups. PowerShell cmdlets including Get-ADUser and Get-ADGroupMember may enumerate members of Active Directory groups.

View MITRE record โ†—

Platforms
LinuxmacOSWindows
Groups Using T1087.002 (29)
G0129
Mustang Panda
๐Ÿ‡ท๐Ÿ‡บ Russia85 techniques23 software
G0096
APT41
๐Ÿ‡จ๐Ÿ‡ณ China82 techniques32 software
G1017
Volt Typhoon
๐Ÿ‡จ๐Ÿ‡ณ China81 techniques17 software
G0034
Sandworm Team
๐Ÿ‡ท๐Ÿ‡บ Russia79 techniques27 software
G0049
OilRig
๐Ÿ‡ฎ๐Ÿ‡ท Iran76 techniques30 software
G0069
MuddyWater
๐Ÿ‡ฎ๐Ÿ‡ท Iran68 techniques21 software
G0010
Turla
๐Ÿ‡ท๐Ÿ‡บ Russia68 techniques30 software
G0046
FIN7
67 techniques19 software
G1015
Scattered Spider
64 techniques9 software
G0102
Wizard Spider
๐Ÿ‡ท๐Ÿ‡บ Russia64 techniques22 software
G1055
VOID MANTICORE
๐Ÿ‡ฎ๐Ÿ‡ท Iran63 techniques0 software
G0114
Chimera
๐Ÿ‡จ๐Ÿ‡ณ China59 techniques6 software
G0035
Dragonfly
๐Ÿ‡ท๐Ÿ‡บ Russia56 techniques10 software
G1016
FIN13
53 techniques4 software
G1043
BlackByte
48 techniques8 software
G0045
menuPass
๐Ÿ‡จ๐Ÿ‡ณ China46 techniques25 software
G0004
Ke3chang
๐Ÿ‡จ๐Ÿ‡ณ China46 techniques11 software
G1054
MirrorFace
๐Ÿ‡จ๐Ÿ‡ณ China43 techniques16 software
G1004
LAPSUS$
43 techniques1 software
G1053
Storm-0501
42 techniques8 software
G0117
Fox Kitten
๐Ÿ‡ฎ๐Ÿ‡ท Iran41 techniques5 software
G1039
RedCurl
๐Ÿ‡ท๐Ÿ‡บ Russia41 techniques0 software
G0060
BRONZE BUTLER
๐Ÿ‡จ๐Ÿ‡ณ China40 techniques14 software
G0037
FIN6
40 techniques12 software
G1046
Storm-1811
31 techniques7 software
G1022
ToddyCat
25 techniques9 software
G1032
INC Ransom
25 techniques8 software
G0030
Lotus Blossom
21 techniques9 software
G0033
Poseidon Group
8 techniques0 software
โ†‘