T1087No distinct observable

Account Discovery

DiscoveryESXi, IaaS, Identity Provider, Linux, macOS, Office Suite, SaaS, Windows

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

Every observable in the brief belongs to one of the four children, and the two things MITRE says would lift it to the parent are not expressible in the Sigma subset lib/sigma models. AN1612 (Windows) puts 'net user', 'Get-ADUser' and 'dsquery' in its CommandLinePattern knob: Get-ADUser and dsquery read the domain directory, which is T1087.002, while bare 'net user' reads the local SAM, which is T1087.001, and nothing in the analytic separates them at the parent — a rule ORing them together would be two children's detections filed under the parent tag. That analytic's third log source, Security 4798/4799, is 'a user's local group membership was enumerated' and 'a security-enabled local group membership was enumerated': local, and group rather than account, so it lands on T1087.001 and T1069.001, and T1069 is itself already declined here for the same parent-versus-child reason. […]

Covered instead by T1087.001, T1087.002, T1087.003, T1087.004, T1033, T1069.

What the technique is

Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts). Adversaries may use several methods to enumerate accounts, including abuse of existing tools, built-in commands, and potential misconfigurations that leak account names and roles or permissions in the targeted environment. For examples, cloud environments typically provide easily accessible interfaces to obtain user lists. On hosts, adversaries can use default PowerShell and other command line functionality to identify accounts. Information about email addresses and accounts may also be extracted by searching an infected system’s files.

Read it on attack.mitre.org

What MITRE says you would watch

AN1612
Detection of processes performing local or domain account enumeration by invoking account directory queries or security APIs followed by structured output of account lists. The defender observes command execution or API invocation patterns that retrieve account information and produce enumeration artifacts shortly afterward.
AN1613
Enumeration of users and groups through suspicious shell commands or unauthorized access to /etc/passwd or /etc/shadow.
AN1614
Detection of account enumeration through directory service queries or system utilities accessing account metadata stores, followed by structured enumeration output.