Account Discovery
Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., [Valid Accounts](https://attack.mitre.org/techniques/T1078)). Adversaries may use several methods to enumerate accounts, including abuse of existing tools, built-in commands, and ...
BY SOURCE
PROCEDURES (35)
Auto-extracted: 5 detections for general monitoring
Auto-extracted: 4 detections for process creation monitoring
Auto-extracted: 2 detections for exfiltrat
Auto-extracted: 2 detections for event log
Auto-extracted: 2 detections for service
Auto-extracted: 2 detections for azure
Auto-extracted: 2 detections for privilege
Auto-extracted: 2 detections for cloud
Auto-extracted: 2 detections for powershell
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for dump
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for aws
Auto-extracted: 1 detections for aws
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for aws
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for command line monitoring
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for api
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for dump
Auto-extracted: 1 detections for exfiltrat