Log in Request a demo

Attack technique

Account Discovery

Account Discovery is when an attacker builds a list of valid accounts, usernames or email addresses on a system or inside a compromised environment.

In short

Account Discovery is when an attacker builds a list of valid accounts, usernames or email addresses on a system or inside a compromised environment. Knowing which accounts exist helps them plan what to do next. MITRE ATT&CK lists it as a Discovery technique.

Last updated 8 October 2026

Profile MapTechnique
  1. Reconnaissance
  2. Resource Development
  3. Initial Access
  4. Execution
  5. Persistence
  6. Privilege Escalation
  7. Stealth
  8. Defense Impairment
  9. Credential Access
  10. Discovery
  11. Lateral Movement
  12. Collection
  13. Command and Control
  14. Exfiltration
  15. Impact

Discovery · Step 10 Of 15 In The Attack Chain

  1. MITRE IDT1087ATT&CK technique
  2. Detection4ways to spot itDirectory and system lookups · Detection strategy MITRE lists
  3. Defences2ways to stop itManage user accounts

How it works

Once inside a network, an attacker often does not know who the users are or which accounts matter. Listing accounts answers that. MITRE says this can help with later steps such as brute-forcing, spear-phishing and account takeover.

Attackers can use existing tools, built-in system commands, or misconfigurations that leak account names, roles or permissions. Cloud environments usually offer easy ways to get a list of users. On a device, default command line features can show accounts, and email addresses can also be found by searching files on an infected system.

MITRE splits the technique into four sub-techniques: local accounts, domain accounts, email accounts and cloud accounts.

A real example

MITRE ATT&CK lists these procedure examples:

  • Havoc can identify privileged user accounts on infected systems.
  • ShimRatReporter listed all privileged and non-privileged accounts available on the machine.
  • TONESHELL included a function to retrieve a list of user accounts.
  • Woody RAT can identify administrator accounts on an infected machine.
  • XCSSET tries to discover accounts from data of apps such as Evernote, Telegram, Skype and WeChat.

How to detect

  1. Account listing commands and queries

    Watch for processes that query account directories or security interfaces and then produce a list of accounts soon after.

  2. Directory and system lookups

    Look for unusual access to system account stores, or directory service queries run by utilities that normally do not do that.

  3. Cloud and identity API activity

    Flag a principal that pulls account or role details in quick succession through cloud or identity provider interfaces.

  4. Detection strategy MITRE lists

    DET0587, Enumeration of User or Account Information Across Platforms.

How to defend

  1. Manage user accounts

    Control how accounts are created, changed, used and what permissions they hold, so there is less to find and less to abuse.

  2. Harden operating system settings

    Configure systems so administrator account names are not revealed during actions such as elevation prompts.

Questions

What is Account Discovery?

Account Discovery is when an attacker builds a list of valid accounts, usernames or email addresses on a system or inside a compromised environment. Knowing which accounts exist helps them plan what to do next.

Why do attackers list accounts?

Once inside a network, an attacker often does not know who the users are or which accounts matter. MITRE says a list can help with later steps such as brute-forcing, spear-phishing and account takeover.

What are the types of Account Discovery?

MITRE splits the technique into four sub-techniques: local accounts, domain accounts, email accounts and cloud accounts. Each covers a different place where an attacker can list accounts, from a single device to cloud services.

How can I detect and reduce Account Discovery?

Watch for processes that query account directories and then produce a list of accounts, and for principals that pull account details quickly through cloud or identity interfaces. Manage how accounts are created and used, so there is less to find and abuse.

In our research

  1. Akira ransomware advisory AA24-109A: stages and tools October 2026
  2. Leaked Credentials from Ransomware Groups: Case Insights October 2025
  3. APT38: From SWIFT Heists to Crypto Fortresses September 2025
  4. [Research Summary]: RokRat June 2024
  5. Xeno RAT Technical Analysis June 2024
  6. Mustang Panda Threat group

Sources

  1. MITRE ATT&CK T1087: Account Discovery MITRE
  2. MITRE ATT&CK Tactic: Discovery MITRE

Browse the threat library

Keep exploring

Knowledge Hub

Threat group

Mustang Panda

MITRE ATT&CK describes Mustang Panda as a China-based cyber espionage threat actor, and the US Department of Justice, citing court documents, says the PRC government paid the group to develop a version of PlugX. It is said to target governments, diplomats, think tanks and civil society through phishing emails with decoy documents.

Read more

Glossary term

Brute force attack

A brute force attack is a method of guessing passwords or other secret values by trying many combinations until one works.

Read more