T1087 and T1069 Account and Permission Group Discovery Defensive Guide: Detecting Directory and Cloud Enumeration

Before an intruder can target the right account, they need to know which accounts exist and which groups hold power, and most directories hand that list to any authenticated user. MITRE ATT&CK T1087 Account Discovery and T1069 Permission Groups Discovery cover that enumeration, on hosts, in Active Directory, in mail systems and in cloud and SaaS tenants, including the service accounts and roles that non-human identities use. Both sit in the Discovery tactic (TA0007) in ATT&CK v20 and are recorded for a long list of groups, from APT29 and FIN7 to Scattered Spider, Volt Typhoon and ShinyHunters. This guide goes deeper than our general discovery page: it explains what each sub-technique looks like to a defender, which Windows, directory and cloud settings reduce what an ordinary account can enumerate, and how to detect enumeration without drowning in the legitimate queries that every domain generates. It is for detection engineers, identity teams and cloud security owners; it contains no attack procedures.

Key takeaways

• Discovery is cheap and almost universal. ATT&CK lists dozens of groups for T1087 and T1069, and the techniques use built-in tools and APIs, so prevention is about reducing what is visible, not blocking a binary.
• Restrict remote SAM first. The "Network access: Restrict clients allowed to make remote calls to SAM" policy has an audit-only mode and needs no reboot, which makes it one of the safest high-value hardening steps on Windows.
• Context beats command matching. Group enumeration from a domain controller admin workstation is normal; the same queries from a web server, a build agent or a service account are not.
• Cloud enumeration is an API pattern. Calls such as iam list-users, GetAccountAuthorizationDetails or gcloud projects get-iam-policy from a workload identity that never makes them are a strong signal.
• Decoys turn noise into certainty. A honeytoken account or a decoy privileged group that nobody legitimately queries gives a near zero false positive alert for directory reconnaissance.

How the attack works

ATT&CK describes Account Discovery as getting "a listing of valid accounts, usernames, or email addresses" to support follow-on behaviour such as brute forcing, spear phishing or account takeover through T1078 Valid Accounts. Permission Groups Discovery is the companion technique: working out which groups exist, who is in them and which users and groups have elevated permissions. In practice they run together, often within seconds, and are followed by credential attacks against the accounts that matter, such as T1558.003 Kerberoasting against service accounts with SPNs. See the Discovery and Reconnaissance Techniques Guide for the wider tactic.

A single AWS call, GetAccountAuthorizationDetails, returns users with their group memberships and policies, groups, roles with their trust policies, and managed policies in one paginated response. It is a legitimate audit API and a complete map for an intruder, which makes it one of the most useful single calls to alert on outside approved tooling.

Where it shows up

• Early hands-on-keyboard activity: after initial access, operators commonly run local and domain enumeration from the first host to decide where to go next, and ransomware affiliates repeat it at scale before deployment.
• Kerberoasting preparation: Microsoft notes that suspicious LDAP enumeration of sensitive groups is often the first phase of Kerberoasting. See the Kerberoasting and AS-REP Roasting Defence Guide.
• Attack path tooling: collectors that query LDAP and SAMR to build a graph of group membership and ACLs. See the BloodHound and Active Directory Attack Path Guide.
• Identity provider and SaaS tenants: groups such as Scattered Spider, LAPSUS$ and ShinyHunters are recorded for T1069, and cloud admin consoles and Graph style APIs give any member user broad read access by default.
• Workload identities: a stolen access key or token for a service account or CI role is often used first to list identities and policies, because the intruder does not yet know what the identity can do.

Impact

• Target selection: privileged groups, service accounts with SPNs, break-glass accounts and dormant accounts become the shortlist for credential attacks.
• Attack path discovery: group nesting and delegated rights reveal indirect routes to tier 0 that defenders often have not mapped themselves.
• Phishing and social engineering: global address lists and org data give names, roles and managers for convincing lures and help desk impersonation.
• Cloud privilege mapping: role trust policies and attached policies show which identities can assume which roles, including cross-account trusts.
• Low direct damage, high leverage: discovery rarely harms anything on its own, which is why it is often ignored; it is one of the earliest points at which an intrusion can be caught.

Detection

ATT&CK v20 detection strategies for these techniques describe analytics such as domain account enumeration through net.exe, PowerShell, WMI or LDAP "from non-domain controllers or non-admin endpoints", tuned for bursts of enumeration within a time window and restricted to hosts where such commands are unexpected. On Linux they point to execve audit records for ldapsearch, wbinfo and getent passwd, and for cloud to API, CLI and scripting interface calls in control plane logs.

Building low-noise analytics

1. Baseline the legitimate enumerators: identity management servers, IGA connectors, vulnerability scanners, monitoring tools and administrators' privileged access workstations. Record them by host, account and process.
2. Alert on role mismatch: enumeration by a web server worker, a database service account, a CI runner or a workload role is far rarer than enumeration by people.
3. Score sequences, not single commands: one whoami is noise; whoami, local group, domain group and domain trust queries (T1482) within minutes from one logon session is a pattern.
4. Plant decoys: a honeytoken user with an attractive name and an SPN, and a decoy privileged group, are rarely touched by legitimate tools that do not enumerate everything. See the Honeytokens and Canary Credentials Guide.
5. Join with authentication: enumeration followed by Kerberos service ticket requests (4769) for many SPNs, or by spraying, should raise severity automatically.

Metrics

• Coverage: percentage of domain controllers, servers and cloud accounts sending the telemetry above.
• Exposure: number of hosts still allowing remote SAM enumeration by non-administrators.
• Decoy health: honeytoken accounts deployed and tested in the last quarter, and time from decoy query to alert.
• Precision: share of discovery alerts closed as known tooling; a falling rate shows baselining is working.
• Dwell before escalation: in exercises, time from first enumeration to detection, compared with time to the first credential attack.

Prevention and hardening

ATT&CK maps three mitigations to T1087 (M1018 User Account Management, M1028 Operating System Configuration and M1047 Audit) and none to T1069, which is honest: you cannot stop a domain member reading most of the directory. The aim is to remove anonymous and unnecessary visibility, shrink what each identity can read, and make the remaining reads observable.

Rolling out restrict remote SAM

1. Audit: set RestrictRemoteSamAuditOnlyMode to 1 on a pilot group of member servers and workstations and collect events 16968 for two to four weeks.
2. Allow what is needed: add the accounts of tools that genuinely need remote SAM (some management and inventory tools) to the security descriptor.
3. Enforce by ring: apply the Group Policy to workstations, then member servers; check Exchange offline address book generation if you still run Exchange 2013 or 2016.
4. Domain controllers last: decide deliberately whether to restrict them, since the default there allows everyone read access for compatibility.
5. Roll back: clearing the policy takes effect without a reboot; the last writer (local or Group Policy) wins, so remove conflicting local settings.

Small and large organisations

A small organisation should restrict remote SAM, remove broad cloud read permissions from application identities and deploy one or two honeytoken accounts; that covers most of the value. A large organisation adds identity threat detection at domain controllers, sequence-based analytics in the SIEM, CIEM-style reviews of who can list identities and policies across cloud accounts, and red team exercises that measure time to detect discovery. See the ITDR Guide.

Where identity fits

These techniques are identity reconnaissance. Service accounts, workload roles, API keys and CI identities are both the targets (privileged, rarely monitored, often with SPNs) and the vehicles (a stolen key is used to ask "what can I see?"). Inventory non-human identities, record which ones are expected to call directory or IAM listing APIs, and treat any other non-human identity doing so as a likely compromise. Rotate the credential first, then investigate. See the Service Account Security Guide.

Framework mapping

Practitioner checklist

• Enable Audit Security Group Management and collect 4798 and 4799, plus PowerShell 4104, from servers and workstations.
• Deploy restrict remote SAM in audit mode, review 16968 events, then enforce by ring.
• Baseline legitimate enumerators by host, account and process, and alert on everything else.
• Alert on identity listing APIs, including GetAccountAuthorizationDetails, called by application or CI identities.
• Remove List and Get IAM permissions from workload roles that do not need them.
• Restrict Entra guest access and review which applications hold directory read permissions.
• Deploy at least one honeytoken user and one decoy privileged group, and test the alert quarterly.
• Correlate discovery with Kerberos ticket requests and failed sign-ins to raise severity automatically.

Standards and references

• MITRE ATT&CK: Account Discovery (T1087)
• MITRE ATT&CK: Permission Groups Discovery (T1069)
• Microsoft Learn: Network access: Restrict clients allowed to make remote calls to SAM
• Microsoft Learn: 4799 A security-enabled local group membership was enumerated
• Microsoft Learn: Defender for Identity classic security alerts
• Microsoft Learn: Default user permissions in Microsoft Entra ID
• AWS: GetAccountAuthorizationDetails API reference
• MITRE D3FEND: Decoy User Credential

Related NHI Mgmt Group resources: Discovery and Reconnaissance Techniques Guide · Active Directory Security Monitoring and Event IDs Guide · MITRE ATT&CK T1078 Valid Accounts Guide · T1580 and T1619 Cloud Infrastructure and Storage Discovery Guide · Deception Technology Guide