T1087.002Discovery

Domain Account Discovery

Enumerate domain users / groups via LDAP, net, ADModule, etc.

§ Where this technique fits

T1087.002 is catalogued under the Discovery tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 1 on average.

Authoritative reference: attack.mitre.org/techniques/T1087/002/.

§ Dossiers chaining this technique

AS-REP roast → cracked user → Kerberoast → service-account admin
Anonymous attacker recovers a user password via AS-REP roasting, authenticates, kerberoasts a service account with weak password, and lands on a high-value server.
step 1 / 8

§ What commonly comes next

01
AS-REP Roasting
T1558.004 · Credential Access
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

AS-REP roast → cracked user → Kerberoast → service-account admin

§ What commonly comes next