dsquery — Malware Profile

dsquery is a command-line utility that can be used to query Active Directory for information from a system within a domain. It is typically installed only on Windows Server versions but can be installed on non-server variants through the Microsoft-provided Remote Server Administration Tools bundle.

MITRE ATT&CK techniques (4)

• T1069.002 Domain Groups
• T1082 System Information Discovery
• T1087.002 Domain Account
• T1482 Domain Trust Discovery

Attributed threat actors

• FIN8
• APT41

Read the full analysis on IntelFusions