Domain Account Enumeration - Active Directory User Discovery

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•2

Detects reconnaissance activity where adversaries enumerate domain user accounts using standard Windows command-line tools, PowerShell Active Directory modules, and direct LDAP queries. This behavior is commonly performed to identify user accounts for subsequent password spraying, brute force attacks, or privilege escalation.