S0105tool

dsquery

a.k.a. dsquery.exe

dsquery is a command-line utility that can be used to query Active Directory for information from a system within a domain. It is typically installed only on Windows Server versions but can be installed on non-server variants through the Microsoft-provided Remote Server Administration Tools bundle.

Platforms: Windows

MITRE ATT&CK ↗

Linked entities · 6

usesT1087.002Domain Account usesT1482Domain Trust Discovery usesT1069.002Domain Groups usesT1082System Information Discovery uses byG0096APT41 uses byG0061FIN8