Domain Account
Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges. Commands such as <code>net user /domain</code> and <code>net group /domain</code> of the [Net](https://attack.mitre.org/software/S0039) utility, <code>dscacheutil -q group</code> on macOS, and <code>ldapsearch</code> on Linux can list domain users and groups. ...
BY SOURCE
PROCEDURES (29)
Auto-extracted: 6 detections for process creation monitoring
Auto-extracted: 5 detections for script block
Auto-extracted: 5 detections for general monitoring
Auto-extracted: 4 detections for script block
Auto-extracted: 4 detections for lateral
Auto-extracted: 3 detections for privilege
Auto-extracted: 2 detections for powershell
Auto-extracted: 2 detections for powershell
Auto-extracted: 2 detections for wmi
Auto-extracted: 2 detections for persist
Auto-extracted: 2 detections for spray
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for wmi
Auto-extracted: 1 detections for spray
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for service monitoring
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for api
Auto-extracted: 1 detections for api
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for dump
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for dump
Auto-extracted: 1 detections for file monitoring
Auto-extracted: 1 detections for azure
Auto-extracted: 1 detections for azure
Auto-extracted: 1 detections for script execution monitoring