Account Discovery

Adversaries may attempt to list valid accounts, usernames, or email addresses on a system or across an environment to identify targets for follow-on activity. T1087 includes local, domain, email, and cloud account discovery. The steps below are independent, platform- and scope-specific command examples; choose the authorized local-host or directory query that fits the target and available access.