Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., [Valid Accounts](https://attack.mitre.org/techniques/T1078)).

Adversaries may use several methods to enumerate accounts, including abuse of existing tools, built-in commands, and potential misconfigurations that leak account names and roles or permissions in the targeted environment.

For examples, cloud environments typically provide easily accessible interfaces to obtain user lists.(Citation: AWS List Users)(Citation: Google Cloud - IAM Servie Accounts List API) On hosts, adversaries can use default [PowerShell](https://attack.mitre.org/techniques/T1059/001) and other command line functionality to identify accounts. Information about email addresses and accounts may also be extracted by searching an infected system’s files.
Account Discovery
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1087  external_id: T1087     source_name: AWS List Users  description: Amazon. (n.d.). List Users. Retrieved August 11, 2020.  url: https://docs.aws.amazon.com/cli/latest/reference/iam/list-users.html     source_name: Google Cloud - IAM Servie Accounts List API  description: Google. (2020, June 23). gcloud iam service-accounts list. Retrieved August 4, 2020.  url: https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/list     source_name: Elastic - Koadiac Detection with EQL  description: Stepanic, D.. (2020, January 13). Embracing offensive tooling: Building detections against Koadic using EQL. Retrieved November 30, 2020.  url: https://www.elastic.co/blog/embracing-offensive-tooling-building-detections-against-koadic-using-eql     