Threadlinqs IntelligenceStart free

ATT&CK techniqueDiscovery

T1087 Account Discovery

DiscoveryEnterprise

As of 2026-10-05, T1087 (Account Discovery) appears in 339 tracked threats, first reported 2026-01-29 and most recently 2026-10-03, with linked actors including ShinyHunters, TeamPCP, MuddyWater; it most often appears alongside T1078 (Valid Accounts).

Tracked threats
339149 critical, 159 high, 27 medium
First seen
2026-01-29
Last seen
2026-10-03
Threat actors
112In the threats using it
Detection rules
180Blue tier and above

Data as of:

Activity timeline

T1087 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 126 reports, and 339 of the 339 threats were reported in the twelve months to 2026-10.

How adversaries use it

T1087 Account Discovery is catalogued by MITRE ATT&CK under the Discovery tactic in the Enterprise matrix. Threadlinqs maps 339 of 2623 tracked threats (12.9%) to it; by severity that is 149 critical, 159 high, 27 medium.

Threats that use T1087 most often also use T1078 Valid Accounts (203 threats), T1059 Command and Scripting Interpreter (202 threats), T1190 Exploit Public-Facing Application (174 threats), T1071 Application Layer Protocol (173 threats), T1005 Data from Local System (168 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

112 tracked threat actors appear in the threats that use T1087; the most frequent are ShinyHunters (9), TeamPCP (9), MuddyWater (7), UNC6240 (7), APT38 (6).

Mitigations

MITRE ATT&CK lists 2 mitigations for T1087.

Data sources

Telemetry that can reveal T1087, per MITRE ATT&CK.

  • Command — Command Execution
  • File — File Access
  • Process — Process Creation

Threat actors using it

Tracked threats

The 30 most recent of 339 tracked threats that use T1087.

Detection coverage

Threadlinqs maintains 180 detection rules mapped to T1087 (SPL 56, KQL 73, Sigma 51). Rule content is available to Blue tier accounts and above; this page shows counts only.

180 detection rules (SPL/KQL/Sigma) · Blue and above. Compare plans

Sub-techniques