Before an intruder can target the right account, they need to know which accounts exist and which groups hold power, and most directories hand that list to any authenticated user. MITRE ATT&CK T1087 Account Discovery and T1069 Permission Groups Discovery cover that enumeration, on hosts, in Active Directory, in mail systems and in cloud and SaaS tenants, including the service accounts and roles that non-human identities use. Both sit in the Discovery tactic (TA0007) in ATT&CK v20 and are recorded for a long list of groups, from APT29 and FIN7 to Scattered Spider, Volt Typhoon and ShinyHunters. This guide goes deeper than our general discovery page: it explains what each sub-technique looks like to a defender, which Windows, directory and cloud settings reduce what an ordinary account can enumerate, and how to detect enumeration without drowning in the legitimate queries that every domain generates. It is for detection engineers, identity teams and cloud security owners; it contains no attack procedures.
Key takeaways
- Discovery is cheap and almost universal. ATT&CK lists dozens of groups for T1087 and T1069, and the techniques use built-in tools and APIs, so prevention is about reducing what is visible, not blocking a binary.
- Restrict remote SAM first. The "Network access: Restrict clients allowed to make remote calls to SAM" policy has an audit-only mode and needs no reboot, which makes it one of the safest high-value hardening steps on Windows.
- Context beats command matching. Group enumeration from a domain controller admin workstation is normal; the same queries from a web server, a build agent or a service account are not.
- Cloud enumeration is an API pattern. Calls such as
iam list-users,GetAccountAuthorizationDetailsorgcloud projects get-iam-policyfrom a workload identity that never makes them are a strong signal. - Decoys turn noise into certainty. A honeytoken account or a decoy privileged group that nobody legitimately queries gives a near zero false positive alert for directory reconnaissance.
How the attack works
ATT&CK describes Account Discovery as getting "a listing of valid accounts, usernames, or email addresses" to support follow-on behaviour such as brute forcing, spear phishing or account takeover through T1078 Valid Accounts. Permission Groups Discovery is the companion technique: working out which groups exist, who is in them and which users and groups have elevated permissions. In practice they run together, often within seconds, and are followed by credential attacks against the accounts that matter, such as T1558.003 Kerberoasting against service accounts with SPNs. See the Discovery and Reconnaissance Techniques Guide for the wider tactic.
| Sub-technique (v20) | Scope | Typical interfaces named by ATT&CK | What the defender sees |
|---|---|---|---|
| T1087.001 Local Account | Windows, Linux, macOS, ESXi | net user, net localgroup, id, groups, reading /etc/passwd, dscl . list /Users, esxcli system account list | Process creation with these command lines; event 4798 and 4799 on Windows |
| T1087.002 Domain Account | Windows, Linux, macOS | net user /domain, Get-ADUser, ldapsearch, dscacheutil | LDAP search volume and filters at domain controllers, SAMR calls, PowerShell script block logs |
| T1087.003 Email Account | Windows, Office Suite | Get-GlobalAddressList, Google Workspace Directory listing | Bulk address list reads in mail audit logs |
| T1087.004 Cloud Account | IaaS, Identity Provider, SaaS, Office Suite | az ad user list, aws iam list-users, aws iam list-roles, gcloud iam service-accounts list | Control plane audit logs (CloudTrail, Entra audit and sign-in logs, Cloud Audit Logs) |
| T1069.001 Local Groups | Windows, Linux, macOS | net localgroup, groups, dscl . -list /Groups | Event 4799 for security-enabled local group enumeration |
| T1069.002 Domain Groups | Windows, Linux, macOS | net group /domain, ldapsearch, dscacheutil -q group | Queries for Domain Admins, Enterprise Admins and other tier 0 groups |
| T1069.003 Cloud Groups | SaaS, IaaS, Office Suite, Identity Provider | az ad user get-member-groups, AWS ListRolePolicies and ListAttachedRolePolicies, GetBucketAcl, Google Cloud Identity groups API | Policy and role listing calls from unusual principals or locations |
A single AWS call, GetAccountAuthorizationDetails, returns users with their group memberships and policies, groups, roles with their trust policies, and managed policies in one paginated response. It is a legitimate audit API and a complete map for an intruder, which makes it one of the most useful single calls to alert on outside approved tooling.
Where it shows up
- Early hands-on-keyboard activity: after initial access, operators commonly run local and domain enumeration from the first host to decide where to go next, and ransomware affiliates repeat it at scale before deployment.
- Kerberoasting preparation: Microsoft notes that suspicious LDAP enumeration of sensitive groups is often the first phase of Kerberoasting. See the Kerberoasting and AS-REP Roasting Defence Guide.
- Attack path tooling: collectors that query LDAP and SAMR to build a graph of group membership and ACLs. See the BloodHound and Active Directory Attack Path Guide.
- Identity provider and SaaS tenants: groups such as Scattered Spider, LAPSUS$ and ShinyHunters are recorded for T1069, and cloud admin consoles and Graph style APIs give any member user broad read access by default.
- Workload identities: a stolen access key or token for a service account or CI role is often used first to list identities and policies, because the intruder does not yet know what the identity can do.
Impact
- Target selection: privileged groups, service accounts with SPNs, break-glass accounts and dormant accounts become the shortlist for credential attacks.
- Attack path discovery: group nesting and delegated rights reveal indirect routes to tier 0 that defenders often have not mapped themselves.
- Phishing and social engineering: global address lists and org data give names, roles and managers for convincing lures and help desk impersonation.
- Cloud privilege mapping: role trust policies and attached policies show which identities can assume which roles, including cross-account trusts.
- Low direct damage, high leverage: discovery rarely harms anything on its own, which is why it is often ignored; it is one of the earliest points at which an intrusion can be caught.
Detection
ATT&CK v20 detection strategies for these techniques describe analytics such as domain account enumeration through net.exe, PowerShell, WMI or LDAP "from non-domain controllers or non-admin endpoints", tuned for bursts of enumeration within a time window and restricted to hosts where such commands are unexpected. On Linux they point to execve audit records for ldapsearch, wbinfo and getent passwd, and for cloud to API, CLI and scripting interface calls in control plane logs.
| Source | Event or signal | Detection idea |
|---|---|---|
| Windows Security log | 4798 (local user group membership enumerated), 4799 (security-enabled local group membership enumerated, Audit Security Group Management) | Enumeration of Administrators or Backup Operators by a process other than known admin tools, correlated with 4688 or Sysmon 1 through the process ID |
| Process telemetry | Sysmon 1 or EDR process events; PowerShell 4103 and 4104 | Several discovery commands (whoami /groups, net group /domain, Get-ADGroupMember) from one session in a short window, especially from servers or service accounts |
| Domain controllers | LDAP query telemetry, SAMR network activity | Broad or high-volume queries for privileged groups, adminCount=1 or SPN-bearing accounts from workstations that never make them |
| Defender for Identity (classic alerts) | Account Enumeration reconnaissance (LDAP) 2437; User and Group membership reconnaissance (SAMR) 2021; Security principal reconnaissance (LDAP) 2038; Honeytoken was queried via LDAP 2429 | Use as high-quality signals; note the SAMR alert learns for four weeks per domain controller and the LDAP principal reconnaissance alert for 15 days per computer |
| Restrict remote SAM audit events | System log, source Directory-Service-SAM, 16965 (call denied) and 16968 (would have been denied in audit mode) | Inventory who makes remote SAM calls before enforcing, then alert on denials |
| AWS CloudTrail | ListUsers, ListRoles, ListAttachedRolePolicies, GetAccountAuthorizationDetails, GetBucketAcl | A principal calling several identity listing APIs it has never called before, or any of them from an access key used by an application |
| Entra ID and Microsoft 365 | Sign-in logs for Graph and Azure CLI clients, audit logs | Directory reads from new client applications or unfamiliar locations, mass address list access |
| Linux | auditd execve; nslcd or winbind logs | getent, ldapsearch or wbinfo -u run by web server or application accounts |
Building low-noise analytics
- Baseline the legitimate enumerators: identity management servers, IGA connectors, vulnerability scanners, monitoring tools and administrators' privileged access workstations. Record them by host, account and process.
- Alert on role mismatch: enumeration by a web server worker, a database service account, a CI runner or a workload role is far rarer than enumeration by people.
- Score sequences, not single commands: one
whoamiis noise;whoami, local group, domain group and domain trust queries (T1482) within minutes from one logon session is a pattern. - Plant decoys: a honeytoken user with an attractive name and an SPN, and a decoy privileged group, are rarely touched by legitimate tools that do not enumerate everything. See the Honeytokens and Canary Credentials Guide.
- Join with authentication: enumeration followed by Kerberos service ticket requests (4769) for many SPNs, or by spraying, should raise severity automatically.
Metrics
- Coverage: percentage of domain controllers, servers and cloud accounts sending the telemetry above.
- Exposure: number of hosts still allowing remote SAM enumeration by non-administrators.
- Decoy health: honeytoken accounts deployed and tested in the last quarter, and time from decoy query to alert.
- Precision: share of discovery alerts closed as known tooling; a falling rate shows baselining is working.
- Dwell before escalation: in exercises, time from first enumeration to detection, compared with time to the first credential attack.
Prevention and hardening
ATT&CK maps three mitigations to T1087 (M1018 User Account Management, M1028 Operating System Configuration and M1047 Audit) and none to T1069, which is honest: you cannot stop a domain member reading most of the directory. The aim is to remove anonymous and unnecessary visibility, shrink what each identity can read, and make the remaining reads observable.
| Control | Setting or mechanism | Effect and caveats |
|---|---|---|
| Restrict remote SAM | "Network access: Restrict clients allowed to make remote calls to SAM"; registry HKLM\System\CurrentControlSet\Control\Lsa\RestrictRemoteSam (REG_SZ, SDDL) | Non-domain controllers on Windows 10 1607 and Server 2016 or later default to Administrators only (O:SYG:SYD:(A;;RC;;;BA)); domain controllers default to allowing everyone read access for compatibility. Test with RestrictRemoteSamAuditOnlyMode=1 first; no reboot needed. Microsoft notes possible impact on Exchange 2013 and 2016 offline address book generation. |
| Entra ID member permissions | authorizationPolicy property AllowedToReadOtherUsers; "Restrict access to Microsoft Entra administration portal" | Setting the first to false stops non-admins reading user information but Microsoft does not recommend it except in special circumstances. The portal restriction is explicitly not a security measure: Graph and PowerShell still work. |
| Guest access restrictions | Entra guest user access setting | Limits what B2B guests can enumerate; set to the most restrictive level the business allows. |
| Cloud least privilege | Remove iam:List*, iam:Get* and broad read roles from workload identities that do not need them | Application roles rarely need to list identities; read-only "security audit" style policies are frequently over-granted. See the AWS IAM Policies and Roles Guide. |
| Hide privileged structure | Fewer members in tier 0 groups, no nested groups inside them, separate admin accounts | Does not stop enumeration but shrinks the useful target list. |
| Admin tiering | Privileged access workstations, tiered admin model | Makes legitimate enumeration come from a small, known set of hosts, which is what makes detection precise. |
| Service account hygiene | gMSA for Windows services, no interactive logon, long random passwords | Microsoft's own prevention advice for the LDAP principal reconnaissance alert. See the Group Managed Service Accounts (gMSA) Guide. |
Rolling out restrict remote SAM
- Audit: set
RestrictRemoteSamAuditOnlyModeto 1 on a pilot group of member servers and workstations and collect events 16968 for two to four weeks. - Allow what is needed: add the accounts of tools that genuinely need remote SAM (some management and inventory tools) to the security descriptor.
- Enforce by ring: apply the Group Policy to workstations, then member servers; check Exchange offline address book generation if you still run Exchange 2013 or 2016.
- Domain controllers last: decide deliberately whether to restrict them, since the default there allows everyone read access for compatibility.
- Roll back: clearing the policy takes effect without a reboot; the last writer (local or Group Policy) wins, so remove conflicting local settings.
Small and large organisations
A small organisation should restrict remote SAM, remove broad cloud read permissions from application identities and deploy one or two honeytoken accounts; that covers most of the value. A large organisation adds identity threat detection at domain controllers, sequence-based analytics in the SIEM, CIEM-style reviews of who can list identities and policies across cloud accounts, and red team exercises that measure time to detect discovery. See the ITDR Guide.
Where identity fits
These techniques are identity reconnaissance. Service accounts, workload roles, API keys and CI identities are both the targets (privileged, rarely monitored, often with SPNs) and the vehicles (a stolen key is used to ask "what can I see?"). Inventory non-human identities, record which ones are expected to call directory or IAM listing APIs, and treat any other non-human identity doing so as a likely compromise. Rotate the credential first, then investigate. See the Service Account Security Guide.
Framework mapping
| Framework | Relevant items |
|---|---|
| MITRE ATT&CK v20 | TA0007 Discovery; T1087 (.001 to .004), T1069 (.001 to .003); follow-on T1078, T1558.003, T1110; related T1482 Domain Trust Discovery |
| ATT&CK mitigations | M1018 User Account Management, M1028 Operating System Configuration, M1047 Audit |
| MITRE D3FEND | D3-DUC Decoy User Credential, D3-DO Decoy Object, D3-UBA User Behavior Analysis |
| NIST SP 800-53 Rev. 5 | AC-6 Least Privilege, AC-3 Access Enforcement, AU-12 Audit Record Generation, AU-6 Audit Record Review, Analysis, and Reporting, SI-4 System Monitoring |
| NIST CSF 2.0 | PR.AA-05 (least privilege access permissions), DE.CM-03 (personnel activity and technology usage monitored), DE.AE-02 (adverse events analysed) |
| CIS Controls v8.1 | Control 5 Account Management, Control 6 Access Control Management, Control 8 Audit Log Management |
Practitioner checklist
- Enable Audit Security Group Management and collect 4798 and 4799, plus PowerShell 4104, from servers and workstations.
- Deploy restrict remote SAM in audit mode, review 16968 events, then enforce by ring.
- Baseline legitimate enumerators by host, account and process, and alert on everything else.
- Alert on identity listing APIs, including
GetAccountAuthorizationDetails, called by application or CI identities. - Remove
ListandGetIAM permissions from workload roles that do not need them. - Restrict Entra guest access and review which applications hold directory read permissions.
- Deploy at least one honeytoken user and one decoy privileged group, and test the alert quarterly.
- Correlate discovery with Kerberos ticket requests and failed sign-ins to raise severity automatically.
Standards and references
- MITRE ATT&CK: Account Discovery (T1087)
- MITRE ATT&CK: Permission Groups Discovery (T1069)
- Microsoft Learn: Network access: Restrict clients allowed to make remote calls to SAM
- Microsoft Learn: 4799 A security-enabled local group membership was enumerated
- Microsoft Learn: Defender for Identity classic security alerts
- Microsoft Learn: Default user permissions in Microsoft Entra ID
- AWS: GetAccountAuthorizationDetails API reference
- MITRE D3FEND: Decoy User Credential
Related NHI Mgmt Group resources: Discovery and Reconnaissance Techniques Guide · Active Directory Security Monitoring and Event IDs Guide · MITRE ATT&CK T1078 Valid Accounts Guide · T1580 and T1619 Cloud Infrastructure and Storage Discovery Guide · Deception Technology Guide