Account Discovery
Account discovery enumerates identities available in a system or environment.
What it means
Account discovery enumerates identities available in a system or environment. Results may help an actor choose authentication, phishing, or privilege targets.
An investigation example
A suspicious host queries a broad set of directory accounts and subsequently attempts logins against a subset.
Evidence to examine
Correlate query scope, caller identity, directory audit data, and subsequent authentication patterns.
A common analytical pitfall
Account enumeration is also an administrative function; volume or tool choice alone does not establish intent.
Response considerations
Investigate the origin and use of the results, and reduce unnecessary directory visibility where it creates avoidable exposure.
Account names describe potential identities
Account discovery enumerates identities in a local system, directory, or cloud environment. The result can help someone choose targets or understand the organization. It does not necessarily disclose credentials or grant access to those accounts. Distinguish the visibility of an account from the authority required to use it.
Local accounts, directory users, and cloud identities have different scopes. A list from one system may omit identities managed elsewhere or include disabled and historical entries. Investigators should record what was queried and what the response represents. A broad label such as all users can be misleading when the query covers only one directory or application.
A fictional directory enumeration
An academy's logs show an unfamiliar session requesting a large set of account records shortly before attempts against selected administrator identities. Analysts compare the query pattern with normal directory applications and support tools. The sequence may explain how targets were selected, but the discovery record alone does not establish a successful account takeover.
Review the requesting identity, source system, response scope, and later authentication activity. Some identity systems expose limited directory information by design, while richer details require elevated access. The security response should fit the actual disclosure and misuse path rather than assume every account-listing capability can or should be eliminated.
Separate knowledge from access
Create a fictional directory response containing five accounts, including one disabled account and one service identity. Explain what can be learned and what cannot. Add a failed login event for one account and write a bounded finding. Then state the evidence needed to claim successful use. This teaches careful identity analysis without collecting real directory information or attempting authentication against actual users.
Account identifiers may remain stable while display names change, or similar names may exist in several directories. Include the appropriate tenant, domain, or local-system context when correlating records. This reduces the risk of connecting activity to the wrong identity simply because two names look alike.
Related concepts
References & further reading
Original explanations, with primary references for deeper study.
MITRE ATT&CK T1087: Account Discovery