What is account discovery?¶
Account discovery is activity used to identify user, service, administrator or application accounts within a system or environment.
Avoid the dangerous assumption¶
The dangerous assumption is that listing accounts proves the offender intended to use all of them.
It does not.
An offender may seek to identify:
- current logged-in users
- local accounts
- directory accounts
- administrators
- service accounts
- privileged roles
- inactive accounts
- groups
- application identities.
The information may help them understand which identities could provide greater access or appear legitimate.
Investigators should preserve:
- the command, API call or tool used
- the account performing the discovery
- the target system or directory
- the time
- the output
- later authentication or privilege activity.
Account discovery may be carried out through operating-system commands, directory queries, cloud administration interfaces, scripts or management tools.
Legitimate administrators and applications perform similar queries.
The evidential value lies in context and sequence.
A broad account listing followed by attempts against privileged accounts may support deliberate reconnaissance.
A routine directory synchronisation may produce similar records without human involvement.
Do not assume that discovering an account proves knowledge of its password or successful access.
Likewise, the listed account holder is not implicated merely because their account appeared in the output.
Where account names are later used in authentication attempts, preserve the link between discovery and use. That sequence may support a stronger inference than either event considered alone.
That relationship should be recorded explicitly.
Operational takeaway¶
Establish which accounts were searched for, by what mechanism and what activity followed, and do not confuse discovery with later access or responsibility.