T1087Discovery
Account Discovery
Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts). Adversaries may use several methods to enumerate accounts…
CVEs6
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.6
Reports0
Detections
16 Sigma rules tagged T1087Account DiscoveryT108716 general rules
- Chopper Webshell Process Patternhightest
- HackTool - SOAPHound Executionhightest
- HackTool - winPEAS Executionhightest
- Hacktool Rulerhightest
- Malicious PowerShell Commandlets - PoshModulehightest
- Malicious PowerShell Commandlets - ProcessCreationhightest
- Malicious PowerShell Commandlets - ScriptBlockhightest
- Network Reconnaissance Activityhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Account Discovery
6 CVEs, by priority. Each link shows its badge.- CVE-2023-27532Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function VulnerabilityVeeam · Backup & ReplicationKEVRansomwarePublic exploitHigh · 7.5T1133External Remote ServicesT1059.003Windows Command Shell+4 more · 1 reportMITRE CTID mapping of the KEV entry · follow-on activity80.6%Top 0.38%82.0priority
- CVE-2022-41082Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft · Exchange ServerKEVRansomwarePublic exploitHigh · 8.0T1078Valid AccountsT1059.001PowerShell+4 moreMITRE CTID mapping of the KEV entry · follow-on activity>99.9%Top 0.02%78.6priority
- CVE-2021-44515Zoho Desktop Central Authentication Bypass VulnerabilityZoho · Desktop CentralKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1003OS Credential Dumping+3 moreMITRE CTID mapping of the KEV entry · follow-on activity99.9%Top 0.04%69.9priority
- CVE-2024-13159Ivanti Endpoint Manager (EPM) Absolute Path Traversal VulnerabilityIvanti · Endpoint Manager (EPM)KEVPublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1558Steal or Forge Kerberos Tickets+2 moreMITRE CTID mapping of the KEV entry · follow-on activity>99.9%Top 0.01%68.2priority
- CVE-2024-13160Ivanti Endpoint Manager (EPM) Absolute Path Traversal VulnerabilityIvanti · Endpoint Manager (EPM)KEVPublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1558Steal or Forge Kerberos Tickets+2 moreMITRE CTID mapping of the KEV entry · follow-on activity91.0%Top 0.19%68.2priority
- CVE-2024-13161Ivanti Endpoint Manager (EPM) Absolute Path Traversal VulnerabilityIvanti · Endpoint Manager (EPM)KEVPublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1558Steal or Forge Kerberos Tickets+2 moreMITRE CTID mapping of the KEV entry · follow-on activity89.8%Top 0.21%68.2priority
Linked through a sub-technique
5 more- CVE-2023-3519Citrix NetScaler ADC and NetScaler Gateway Code Injection VulnerabilityCitrix · NetScaler ADC and NetScaler GatewayKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1574Hijack Execution Flow+2 more · 6 reports99.7%Top 0.05%89.9priority
- CVE-2020-1472Microsoft Netlogon Privilege Escalation VulnerabilityMicrosoft · NetlogonKEVRansomwarePublic exploitMedium · 5.5T1133External Remote ServicesT1068Exploitation for Privilege Escalation+4 more · 8 reports99.4%Top 0.06%86.8priority
- CVE-2021-40539Zoho ManageEngine ADSelfService Plus Authentication Bypass VulnerabilityZoho · ManageEngineKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1047Windows Management Instrumentation+11 more · 1 report99.0%Top 0.07%83.7priority
- CVE-2023-32315Ignite Realtime Openfire Path Traversal VulnerabilityIgnite Realtime · OpenfireKEVPublic exploitHigh · 7.5T1505.003Web ShellT1202Indirect Command Execution+2 more · 1 report>99.9%Top 0.01%82.1priority
- CVE-2021-44077Zoho ManageEngine ServiceDesk Plus Remote Code Execution VulnerabilityZoho · ManageEngine ServiceDesk Plus (SDP) / SupportCenter PlusKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1047Windows Management Instrumentation+11 more93.3%Top 0.16%69.8priority