dsexport

dsexport is a command-line utility designed to export records from the directory services database on a local host or from a connected LDAP service. The tool can be used to gather information about users, groups, and computers. The tool can also be used to export the directory services database to a file for offline analysis.

Reconnaissance Discovery

Path: /usr/bin/dsexport
Author: Brendan Chamberlain (@infosecB)
Created: 2023-05-23

Example Use Cases 2

Export local host users #

Export the local host user information to a file

dsexport local_users.txt /Local/Default dsRecTypeStandard:Users

Reconnaissance Discovery T1087.001 ldap users

Export local host groups #

Export the local host group information to a file

dsexport local_groups.txt /Local/Default dsRecTypeStandard:Groups

Reconnaissance Discovery T1069.001 ldap groups

Detections

No detections at time of publishing