{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/active-directory-discovery/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["discovery","active-directory-discovery","lateral-movement","privilege-escalation"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Windows binary \u003ccode\u003equery.exe\u003c/code\u003e is frequently leveraged by threat actors to perform system user discovery, a critical stage in the reconnaissance phase of an attack. By executing this utility, adversaries can enumerate currently logged-in users, mapping the environment to identify high-value targets or accounts with elevated privileges. This technique is often associated with Active Directory discovery efforts and has been documented in various campaigns, including activities related to Medusa Ransomware. While \u003ccode\u003equery.exe\u003c/code\u003e is a standard Windows component, its usage in command-line configurations targeting user information - specifically when not directed at local server contexts - serves as a high-fidelity signal for unauthorized reconnaissance. Defenders should focus on capturing full command-line arguments to distinguish between legitimate administrative troubleshooting and adversary-led discovery operations.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful execution of this discovery technique allows attackers to gain critical situational awareness of the compromised endpoint and the broader network environment. By identifying active users, adversaries can optimize lateral movement paths and identify accounts with the appropriate permissions to escalate privileges or deploy ransomware, ultimately increasing the speed and efficacy of a security incident.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule to monitor for \u003ccode\u003equery.exe\u003c/code\u003e executions that include user enumeration parameters.\u003c/li\u003e\n\u003cli\u003eEstablish a baseline for administrative use of \u003ccode\u003equery.exe\u003c/code\u003e within your environment to tune out false positives originating from authorized IT management activities.\u003c/li\u003e\n\u003cli\u003eEnsure EDR agents are configured to log full command-line strings and parent process information, as this metadata is essential for validating the intent behind \u003ccode\u003equery.exe\u003c/code\u003e execution.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T17:59:51Z","date_published":"2026-10-12T17:59:51Z","id":"https://feed.craftedsignal.io/briefs/2026-10-system-user-discovery/","summary":"Adversaries utilize the Windows utility 'query.exe' to perform system and Active Directory user discovery for situational awareness, facilitating further lateral movement and privilege escalation.","title":"Detection of System User Discovery via query.exe","url":"https://feed.craftedsignal.io/briefs/2026-10-system-user-discovery/"}],"language":"en","title":"CraftedSignal Threat Feed - Active-Directory-Discovery","version":"https://jsonfeed.org/version/1.1"}