Attackers use dsquery to enumerate Active Directory objects, groups, users, and computers during reconnaissance and privilege discovery. It lets them map the directory, identify high-value accounts, and plan lateral movement or escalation. Defenders should flag unusual dsquery use from non-administrative hosts, especially when it follows compromise indicators or accompanies other directory-enumeration commands.
How dsquery fits attacker reconnaissance
dsquery is useful to attackers because it exposes the shape of Active Directory without needing a graphical console or privileged admin workflow. It can return users, groups, computers, and other directory objects quickly, which makes it a practical way to move from an initial foothold to a usable internal map of the domain.
That map is valuable because directory structure often reveals where privilege concentrates, which accounts are likely to matter, and how systems are grouped for access or administration. Attackers commonly use that information to separate ordinary accounts from administrative ones, identify targets for follow-on abuse, and decide where to probe next.
Because dsquery is also a legitimate administrative utility, it blends into normal Windows activity. The command becomes more suspicious when it appears on a workstation or server that does not usually administer Active Directory, or when it is used in bursts alongside other discovery commands that together indicate deliberate internal reconnaissance.
What attackers are trying to learn from Active Directory enumeration
Attackers are usually not using dsquery for its own sake. They are trying to answer practical questions such as which accounts look privileged, which computers may be good stepping stones, and which groups control access to important systems. That reconnaissance can help them choose a path for credential theft, privilege escalation, or lateral movement after the first compromise.
Directory enumeration is especially useful when the attacker has only limited visibility from the compromised host. Even partial results can expose naming patterns, administrative group membership, service accounts, or organizational structure that would be harder to infer from local system data alone. In that sense, dsquery helps convert a single compromised endpoint into domain-wide context.
Living off the Land Guide is relevant here because dsquery sits in the same class of legitimate Windows tooling that attackers repurpose for discovery and stealthy post-compromise activity.
The State of NHI & AI Agent Breach Report 2026 is also useful background because it shows how attackers routinely combine discovery with credential abuse and movement across trusted identities once they have a foothold.
Defensive signals that make dsquery abuse stand out
Unusual dsquery activity is most meaningful when you evaluate it in context, not as a lone command. A single query from a domain admin jump box may be routine, while repeated enumeration from an end-user workstation, a recently compromised host, or a system with no operational reason to query Active Directory can be a strong warning sign.
The strongest signals are usually behavioural: first-time use on a host, rapid-fire queries across multiple object classes, execution shortly after suspicious logon activity, or use alongside other reconnaissance tools such as net, nltest, whoami, or adfind. Those combinations suggest the actor is building a directory picture to support a next-step operation rather than performing normal admin work.
MITRE ATT&CK Enterprise Matrix is a useful companion reference because dsquery-style activity aligns with discovery and privilege-gathering patterns that defenders should map into their detection engineering and hunt logic.
CISA cyber threat advisories can help teams keep those detections aligned with current adversary tradecraft and common intrusion sequences.
Risk and Threat Considerations
dsquery is low-friction, built into the Windows environment, and often allowed to run without raising immediate suspicion. That makes it attractive for living-off-the-land reconnaissance, especially after credential theft or initial compromise has already given the attacker a foothold.
Failure mechanism: The attacker uses a trusted administrative utility to enumerate directory objects, reduce uncertainty about the domain, and identify accounts or systems that increase the chance of successful privilege escalation or lateral movement.
Impact: Once the directory layout is exposed, defenders may face faster spread, more accurate targeting of privileged accounts, and a shorter window before the attacker reaches high-value systems or data.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1087 — Account Discovery | dsquery is used to enumerate users, groups and computers in Active Directory. |
| T1069 — Permission Groups Discovery | Attackers use dsquery to identify privileged groups and memberships in AD. | |
| T1018 — Remote System Discovery | dsquery can enumerate domain computers to identify targets for lateral movement. | |
| Recommendation — Detect directory enumeration and hunt for account discovery executed from unusual hosts. Monitor group discovery activity and flag repeated enumeration of privileged membership. Correlate host discovery with lateral-movement indicators and suspicious admin tooling. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | dsquery abuse is best caught through process and command auditing on endpoints and servers. |
| CIS-13 — Network Monitoring and Defense | Suspicious dsquery patterns often emerge with broader reconnaissance and post-compromise activity. | |
| Recommendation — Collect and review command-line telemetry for directory enumeration from non-admin systems. Correlate endpoint discovery commands with network and authentication anomalies. | ||
Practitioner Guidance
What to verify: Treat dsquery as suspicious when it originates from hosts that do not normally perform directory administration. Confirm the user, source host, command line, timing, and whether the query pattern matches a legitimate operational task.
Decision rule: If dsquery appears alongside other reconnaissance activity or shortly after a suspicious login, escalate it as part of a likely post-compromise sequence rather than as an isolated administrative command.
What good looks like: Detection logic should distinguish routine admin use from exploratory enumeration by combining process telemetry, parent-child process context, host role, and sequence of commands. The goal is to spot directory mapping early, before it turns into privilege abuse or lateral movement.
Practitioner takeaway: The key question is not whether dsquery is malicious by itself, but whether its use fits a normal administrative workflow or an attacker’s attempt to map the domain quietly after compromise.