Behavioral Detection of User Discovery via Local and Remote Enumeration, Detection Strategy DET0093
Excerpt
AN0254
Adversary launches built-in system tools (e.g., whoami, query user, net user) or scripts that enumerate user account information via local execution or remote API queries (e.g., WMI, PowerShell).
Log Sources
Data Component Name Channel
Process Creation (DC0032) WinEventLog:Sysmon EventCode=1
Command Execution (DC0064) WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106 Mutable Elements
Field Description
ParentProcessContext Identify if enumeration originates from non-interactive shell or system service TimeWindow Tune temporal grouping of enumeration + lateral movement attempts
UserContext Flag unexpected users issuing enumeration co…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by MITRE ATT&CK on attack.mitre.org.
More from MITRE ATT&CK43
- techdoc_lite-deliverables-numbered option.dotxMITRE ATT&CK · Added 16 Jun
- Cross-Platform Detection of Data Transfer to Cloud Account, Detection Strategy DET0573MITRE ATT&CK · Added 6 Apr
- Encrypted Channel, Technique T1573 - EnterpriseMITRE ATT&CK · Added 6 Apr
- Boot or Logon Autostart Execution: Time Providers, Sub-technique T1547.003 - EnterpriseMITRE ATT&CK · Added 6 Apr
