MalCommands — dsquery

#					tactics	techniques	os

detail

Command Line

dsquery user -limit 0

Description

Utilize DSQuery to retrieve information about users in Active Directory.

Risk

Low

Risk Reason

On it's own this command doesn't have immediate negative consequences but it's use should be audited if possible to detect potential threats.

Fidelity

Medium

Fidelity Reason

Depending on the organization, it's possible that this is an infrequently used command and it's use may be regularly audited.

Operating Systems

windows

Killchain Phases

Actions on Objectives

References

TOOL DATA

Tool Name: dsquery

Tool URL: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc732952(v=ws.11)

Tool Description: DSQuery provides a mechanism to query Active Directory and is built into Server 2008 and later if the AD DS server role is installed.

Common Tool Locations

C:\Windows\System32\dsquery.exe

Common Tool Arguments

computer - Finds computers in the directory matching specified search criteria.
group - Finds groups in the directory matching specified search criteria.
user - Finds users in the directory matching specified search criteria.
Many More - Follow Tool URL to discover usage capabilities with respect to filtering, searching, etc.

MITRE ATT&CK TECHNIQUES

Technique: T1087.002 - Domain Account

URL: https://attack.mitre.org/techniques/T1087/002

Description: Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior. Commands such as net user /domain and net group /domain of the [Net](https://attack.mitre.org/software/S0039) utility, dscacheutil -q groupon macOS, and ldapsearch on Linux can list domain users and groups.

Tactics:

Discovery