Sigma rule: Domain User Enumeration Network Recon 01

Rule

Title

Domain User Enumeration Network Recon 01

Status

unsupported

Level

medium

Author

Nate Guagenti (@neu5ron), Open Threat Research (OTR)

Date

2020/05/03

Modified

2023/03/24

File

unsupported/zeek/zeek_dce_rpc_domain_user_enumeration.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Domain user and group enumeration via network reconnaissance.
Seen in APT 29 and other common tactics and actors. Detects a set of RPC (remote procedure calls) used to enumerate a domain controller.
The rule was created based off the datasets and hackathon from https://github.com/OTRF/detection-hackathon-apt29

Log source

product

zeek

service

dce_rpc

Detection

selection:
    operation:
        #- LsarEnumerateTrustedDomains #potentially too many FPs, removing. caused by netlogon
        #- SamrEnumerateDomainsInSamServer #potentially too many FPs, removing. #method obtains a listing of all domains hosted by the server side of this protocol. This value is a cookie that the server can use to continue an enumeration on a subsequent call
        - LsarLookupNames3 #method translates a batch of security principal names to their SID form
        - LsarLookupSids3 #translates a batch of security principal SIDs to their name forms
        - SamrGetGroupsForUser #obtains a listing of groups that a user is a member of
        - SamrLookupIdsInDomain #method translates a set of RIDs into account names
        - SamrLookupNamesInDomain #method translates a set of account names into a set of RIDs
        - SamrQuerySecurityObject #method queries the access control on a server, domain, user, group, or alias object
        - SamrQueryInformationGroup #obtains attributes from a group object
timeframe: 30s
condition: selection | count(operation) by src_ip > 4

False positives (as the rule lists them)

• Devices that may do authentication like a VPN or a firewall that looksup IPs to username
• False positives depend on scripts and administrative tools used in the monitored environment

Tags

• attack.discovery
• attack.t1087.002
• attack.t1082

MITRE ATT&CK ids this rule names

• T1082
• T1087.002

References

• https://github.com/OTRF/detection-hackathon-apt29
• https://github.com/OTRF/detection-hackathon-apt29/issues/37

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/unsupported/zeek/zeek_dce_rpc_domain_user_enumeration.yml