Domain account and group enumeration from a command line

Siemphony@siemphonymediumT1087.002verified in lab

Matches the Windows arm of AN0363: a process creation carrying one of the four ways a domain principal list is asked for from a shell — `net`/`net1` with a `user`, `group` or `localgroup` subcommand plus the `/domain` switch, the Active Directory PowerShell cmdlets typed inline, an ADSI or DirectorySearcher LDAP query, and `dsquery`/`dsget` for users or groups. The `/domain` switch is the whole discriminator against the local-account sibling T1087.001: without it `net user` reads the local SAM, so it is required rather than optional in that branch, and both `net.exe` and the `net1.exe` it re-executes are listed because either can be the logged image. MITRE's `CommandLinePattern` knob names `net user /domain`, `Get-ADUser` and `Get-ADGroupMember`; the ADSI, PowerView, WMI and `dsquery` terms are added here, not taken from MITRE. `Get-ADGroup` is written without a suffix so it also covers `Get-ADGroupMember` by substring. Three limits are structural. A cmdlet called from inside a `.ps1`, a module or a here-string never reaches `CommandLine`, and the 4103/4104 script-block leg of the same analytic is a different log source that this rule does not attempt. MITRE's `SourceHost` knob — fire only on hosts that are not domain controllers or admin workstations — has no field in a single process-creation event and has to be applied when the rule is deployed. And `Win32_UserAccount`/`Win32_GroupUser` return local principals as well as domain ones on a domain-joined host, so those two terms overlap T1087.001 by design. This rule is written in the Sysmon EventID 1 vocabulary (`Image`, `CommandLine`) that AN0363 names; an estate feeding Security 4688 instead needs `NewProcessName` mapped onto `Image` first, and 4688 needs both *Audit Process Creation* and the separate *Include command line in process creation events* policy before `CommandLine` exists at all — neither is on by default or in the MS and CIS baselines. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0129, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((((FolderPath endswith "\\net.exe" or FolderPath endswith "\\net1.exe") and (ProcessCommandLine contains " user " or ProcessCommandLine contains " group " or ProcessCommandLine contains " localgroup ")) and (ProcessCommandLine contains " /do" or ProcessCommandLine contains " -do")) or (ProcessCommandLine contains "Get-ADUser" or ProcessCommandLine contains "Get-ADGroup" or ProcessCommandLine contains "Get-ADPrincipalGroupMembership" or ProcessCommandLine contains "Get-DomainUser" or ProcessCommandLine contains "Get-DomainGroupMember" or ProcessCommandLine contains "Get-NetUser" or ProcessCommandLine contains "Get-NetGroupMember" or ProcessCommandLine contains "adsisearcher" or ProcessCommandLine contains "DirectorySearcher" or ProcessCommandLine contains "Win32_UserAccount" or ProcessCommandLine contains "Win32_GroupUser")) or ((FolderPath endswith "\\dsquery.exe" or FolderPath endswith "\\dsget.exe") and (ProcessCommandLine contains " user" or ProcessCommandLine contains " group")))

Splunk · SPL

Run this as a search.

index=* (((((Image="*\\net.exe" OR Image="*\\net1.exe") AND (CommandLine="* user *" OR CommandLine="* group *" OR CommandLine="* localgroup *")) AND (CommandLine="* /do*" OR CommandLine="* -do*")) OR (CommandLine="*Get-ADUser*" OR CommandLine="*Get-ADGroup*" OR CommandLine="*Get-ADPrincipalGroupMembership*" OR CommandLine="*Get-DomainUser*" OR CommandLine="*Get-DomainGroupMember*" OR CommandLine="*Get-NetUser*" OR CommandLine="*Get-NetGroupMember*" OR CommandLine="*adsisearcher*" OR CommandLine="*DirectorySearcher*" OR CommandLine="*Win32_UserAccount*" OR CommandLine="*Win32_GroupUser*")) OR ((Image="*\\dsquery.exe" OR Image="*\\dsget.exe") AND (CommandLine="* user*" OR CommandLine="* group*")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((((TO_LOWER(process.executable) LIKE "*\\\\net.exe" OR TO_LOWER(process.executable) LIKE "*\\\\net1.exe") AND (TO_LOWER(process.command_line) LIKE "* user *" OR TO_LOWER(process.command_line) LIKE "* group *" OR TO_LOWER(process.command_line) LIKE "* localgroup *")) AND (TO_LOWER(process.command_line) LIKE "* /do*" OR TO_LOWER(process.command_line) LIKE "* -do*")) OR (TO_LOWER(process.command_line) LIKE "*get-aduser*" OR TO_LOWER(process.command_line) LIKE "*get-adgroup*" OR TO_LOWER(process.command_line) LIKE "*get-adprincipalgroupmembership*" OR TO_LOWER(process.command_line) LIKE "*get-domainuser*" OR TO_LOWER(process.command_line) LIKE "*get-domaingroupmember*" OR TO_LOWER(process.command_line) LIKE "*get-netuser*" OR TO_LOWER(process.command_line) LIKE "*get-netgroupmember*" OR TO_LOWER(process.command_line) LIKE "*adsisearcher*" OR TO_LOWER(process.command_line) LIKE "*directorysearcher*" OR TO_LOWER(process.command_line) LIKE "*win32_useraccount*" OR TO_LOWER(process.command_line) LIKE "*win32_groupuser*")) OR ((TO_LOWER(process.executable) LIKE "*\\\\dsquery.exe" OR TO_LOWER(process.executable) LIKE "*\\\\dsget.exe") AND (TO_LOWER(process.command_line) LIKE "* user*" OR TO_LOWER(process.command_line) LIKE "* group*")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 3 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\net\.exe$|\\net1\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)( user | group | localgroup )</field>    <field name="CommandLine" type="pcre2">(?i)( /do| -do)</field>    <description>Domain account and group enumeration from a command line (1/3)</description>    <mitre>      <id>T1087.002</id>    </mitre>  </rule>   <rule id="100001" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(Get-ADUser|Get-ADGroup|Get-ADPrincipalGroupMembership|Get-DomainUser|Get-DomainGroupMember|Get-NetUser|Get-NetGroupMember|adsisearcher|DirectorySearcher|Win32_UserAccount|Win32_GroupUser)</field>    <description>Domain account and group enumeration from a command line (2/3)</description>    <mitre>      <id>T1087.002</id>    </mitre>  </rule>   <rule id="100002" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\dsquery\.exe$|\\dsget\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)( user| group)</field>    <description>Domain account and group enumeration from a command line (3/3)</description>    <mitre>      <id>T1087.002</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: discovery_recon
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 3d0e0576-50f1-4922-b244-5f527573e683

ATT&CKT1087.002

T1087.002Domain Account

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondiscovery recon

discovery reconAI draft — unreviewed

01 · What this rule detects

The Windows arm of AN0363: a domain principal list being asked for from a shell. The rule covers four command forms — net/net1 with a user, group or localgroup subcommand plus the /domain switch; the Active Directory PowerShell cmdlets typed inline; an ADSI or DirectorySearcher LDAP query; and dsquery/dsget for users or groups. The /domain switch is what separates this from the local-account sibling T1087.001 — without it, net user reads the local SAM — which is why it is required in that branch rather than optional.

02 · Telemetry you need

category: process_creation, product: windows, in the Sysmon EventID 1 vocabulary (Image, CommandLine) that AN0363 names. An estate feeding Security 4688 needs NewProcessName mapped onto Image first, and 4688 needs both Audit Process Creation and the separate Include command line in process creation events policy before CommandLine exists at all — neither is on by default or in the MS and CIS baselines.
The analytic's second log source, PowerShell 4103/4104, is a feed this rule does not attempt — and a cmdlet called from inside a .ps1 or a module never reaches a command line, so that is where the quieter half of the technique lives.

03 · How the logic works

Three branches, ORed. The net branch is three selections ANDed: selection_net_binary on \net.exe and \net1.exe (both are listed because net.exe re-executes net1.exe and either can be the logged image), selection_net_verb on ' user ', ' group ' or ' localgroup ', and selection_net_domain_flag on ' /do' or ' -do' — a prefix rather than the full /domain, so abbreviations still match. selection_directory_query is an ungated string list, no Image required, on the grounds that these names are distinctive on their own. MITRE's CommandLinePattern knob names net user /domain, Get-ADUser and Get-ADGroupMember; the PowerView, ADSI, WMI and dsquery terms are the pipeline's own additions, not MITRE's. Get-ADGroup is written without a suffix so it also catches Get-ADGroupMember by substring. selection_ds_tools pairs \dsquery.exe/\dsget.exe with ' user' or ' group'. Two limits are structural and worth naming. Win32_UserAccount and Win32_GroupUser return local principals too on a domain-joined host, so those two terms overlap T1087.001 by design — and they are also blind to wmic useraccount get name,sid, because useraccount is a WMIC alias that never puts the class name on the command line. MITRE's SourceHost knob — fire only on hosts that are not domain controllers or admin workstations — has no field in a single process-creation event and must be applied at deployment.

04 · Common false positives

Service desk work is the loudest match by a wide margin: net group "Domain Admins" /domain and Get-ADUser are routine first-line troubleshooting, and on a support desk or jump host they are constant. That is why the rule is medium and not high. Then logon scripts branching on a group check, once per user per session; HR-sync and licence-reconciliation automation under service accounts; inventory agents querying Win32_UserAccount; and dsquery housekeeping.

05 · Detection maturity

tier_1: , and it sits there until it is run against real data. It is derived from a MITRE scaffold with no query logic and has never been executed against a log line — the WMIC-alias gap above was found by reading the rule, not by running it.
tier_2: a fortnight read-only, ranked by host role and account, producing the `SourceHost` scoping.
tier_3: ** the burst correlation, plus the 4104 script-block companion that catches what a command line cannot.

Tuning & false positivesexperimental · 5 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Apply MITRE's SourceHost knob first — it is the single highest-yield filter
Then exclude the automation by account, not by command: service accounts
Consider tightening the two WMI class names with a domain qualifier on the same
Use MITRE's TimeWindow knob downstream to alert on a burst of distinct

Declared by the author

Service desk and administrative troubleshooting. Checking who is in a group with net group "Domain Admins" /domain, confirming an account state with net user jsmith /domain or resolving a membership question with Get-ADUser is routine first-line work, and on a support desk or an admin jump host it is the loudest match here by a wide margin — which is why this rule is medium and not high. MITRE's SourceHost knob is where those hosts are excluded.
Logon scripts and login-time group checks. A startup or logon script that branches on net group "VPN Users" /domain runs on every workstation at every logon, producing one match per user per session across the whole estate with no human involved.
Identity, HR-sync and reporting automation. Joiner-mover-leaver connectors, licence reconciliation jobs and scheduled PowerShell reports call Get-ADUser and Get-ADGroup on a fixed interval from a management server, usually under a service account, and each run enumerates far more objects than an adversary would.
Inventory, monitoring and backup agents that enumerate accounts through WMI. Asset-management and compliance agents query Win32_UserAccount on a schedule on every host, and on a domain-joined machine that class returns domain principals as well as local ones.
Legacy migration and audit tooling built on dsquery/dsget, which is still how a lot of in-house AD housekeeping scripts list users and groups during a maintenance window.

Noise checkfires on 1 of 30

Fires on 1 of 30 ordinary behaviours the baseline holds for this log type. Each is something a managed estate does on purpose, so each is a false positive an analyst would have to close.

pc-helpdesk-net-user-domain
Helpdesk checking an account before a password reset. `net user /domain` is a support routine and a discovery technique at once.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification2 runs

Verified in Siemphony lab

Security Datasets — Domain users enumerated over SAMR (Empire)
passed
Siemphony IR · 3 Sept 2026
2 true · 0 false · 0.0% noise
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
0 true · 1 false · 100.0% noise

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1087.002, evaluated against their process_creation events.

Share this rule

/u/siemphony/3d0e0576-50f1-4922-b244-5f527573e683

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Domain account and group enumeration from a command line

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it