Account Discovery
Technique · ATTACK:enterprise:T1087
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1087",
"title": "Account Discovery",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1087",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--72b74d71-8169-42aa-92e0-e7b04b9f5a08",
"external_id": "T1087",
"domain": "enterprise",
"created": "2017-05-31T21:31:06.988Z",
"modified": "2026-05-12T15:12:00.641Z",
"version": "2.6",
"aliases": [
],
"tactics": [
"discovery"
],
"source_references": [
{
"source_name": "AWS List Users",
"url": "https://docs.aws.amazon.com/cli/latest/reference/iam/list-users.html"
},
{
"source_name": "Google Cloud - IAM Servie Accounts List API",
"url": "https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/list"
},
{
"source_name": "Elastic - Koadiac Detection with EQL",
"url": "https://www.elastic.co/security-labs/embracing-offensive-tooling-building-detections-against-koadic-using-eql"
}
]
}Explicit source assertions (17)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1087
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--02b38264-044a-47ee-b8d8-a08cbb115d06
Crowdstrike HuntReport 2022ATTACK:enterprise:T1087.003 → subtechnique-of → ATTACK:enterprise:T1087
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1713622d-f3fa-4ec4-b63a-3d2a75c23398
ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1087
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2655a359-4baf-4fa0-9f1d-a1f1cf178da1
Mandiant VMware vSphere JUL 2025ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1087
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--47923a37-2b41-4954-850d-ec072f651852
AI-Mexico-Govt-BreachATTACK:enterprise:S0445 → uses → ATTACK:enterprise:T1087
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--52741f41-28c6-4533-bd26-6dc21f6b0794
FOX-IT May 2016 MofangATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1087
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--620d641c-8f76-45f3-a86f-03dd28399d5c
UCF STIG Elevation Account EnumerationATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1087
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--642039f8-984e-432d-a6a3-bc6b4469bba0
MalwareBytes WoodyRAT Aug 2022ATTACK:enterprise:T1087.004 → subtechnique-of → ATTACK:enterprise:T1087
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6b7cd974-07dd-41b2-a40a-5410918a6e17
ATTACK:enterprise:C0062 → uses → ATTACK:enterprise:T1087
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--764862c1-bef5-45e0-9985-3fcae340cb9f
Anthropic AI Orchestrated Campaign NOV 2025ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1087
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8ceb3eaa-24bd-4418-851c-2af2fb3d56d8
Fortinet Havoc MAR 2025ATTACK:enterprise:T1087.002 → subtechnique-of → ATTACK:enterprise:T1087
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a6baf58a-f679-4ba7-abfd-4e1e67ad407b
ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1087
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bb59d6b5-a6a8-4071-b0a7-297593fc078b
ATTACK:enterprise:S1239 → uses → ATTACK:enterprise:T1087
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ccf0d066-a71c-4a8b-b16c-4ddcc8eca267
ZscalerATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1087
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e481bd6a-3143-4fd6-b1d9-97d1060f423d
trendmicro xcsset xcode project 2020ATTACK:enterprise:T1087.001 → subtechnique-of → ATTACK:enterprise:T1087
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e6867d44-3d34-4604-b5e8-35e325051f1e
ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1087
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ecdd1bee-29eb-4f72-a506-6c33777a094f
Volexity SolarWindsATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1087
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ff16c592-9eae-4c27-97a5-444e148883cd
Mandiant FIN13 Aug 2022