value:  CrackMapExec can enumerate the domain user accounts on a targeted system. ;; Dragonfly 2.0 used batch scripts to enumerate users on a victim domain controller. ;; dsquery can be used to gather information on user accounts within a domain. ;; Empire can acquire local and domain user account information. ;; FIN6 has used Metasploit’s PsExec NTDSGRAB module to obtain a copy of the victim's Active Directory database. ;; Fox Kitten has used the Softerra LDAP browser to browse documentation on service accounts. ;; IcedID can query LDAP to identify additional users on the network to infect. ;; Ke3chang performs account discovery using commands such as net localgroup administrators and net group REDACTED" /domain on specific permissions groups. ;; menuPass has used the Microsoft administration tool csvde.exe to export Active Directory data. ;; MuddyWater has used cmd.exe net user /domain to enumerate domain users. ;; Net commands used with the /domain flag can be used to gather information about and manipulate user accounts on the current domain. ;; OilRig has run net user net user /domain net group “domain admins” /domain and net group “Exchange Trusted Subsystem” /domain to get account listings on a victim. ;; Operation Wocao has used the net command to retrieve information about domain accounts. ;; OSInfo enumerates local and domain users ;; Poseidon Group searches for administrator accounts on both the local victim machine and the network. ;; PoshC2 can enumerate local and domain user account information. ;; POWRUNER may collect user account information by running net user /domain or a series of other commands on a victim. ;; Sandworm Team has used a tool to query Active Directory using LDAP discovering information about usernames listed in AD. ;; SoreFang can enumerate domain accounts via net.exe user /domain. ;; Sykipot may use net group "domain admins" /domain to display accounts in the "domain admins" permissions group and net localgroup "administrators" to list local system administrator group membership. ;; Turla has used net user /domain to enumerate domain accounts. ;; Valak has the ability to enumerate domain admin accounts. ;; Wizard Spider has identified domain admins through the use of “net group ‘Domain admins’” commands."
name: Account Discovery: Domain Account