Sigma rule: Potential AD User Enumeration From Non-Machine Account

Rule

Title

Potential AD User Enumeration From Non-Machine Account

Status

test

Level

medium

Author

Maxime Thiebaut (@0xThiebaut)

Date

2020-03-30

Modified

2022-11-08

File

rules/windows/builtin/security/win_security_ad_user_enumeration.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects read access to a domain user from a non-machine account

Log source

product

windows

service

security

definition

Requirements: The "Read all properties" permission on the user object needs to be audited for the "Everyone" principal

Detection

selection:
    EventID: 4662
    # Using contains as the data commonly is structured as "%{bf967aba-0de6-11d0-a285-00aa003049e2}"
    # The user class (https://learn.microsoft.com/en-us/windows/win32/adschema/c-user)
    ObjectType|contains: 'bf967aba-0de6-11d0-a285-00aa003049e2'
    AccessMask|endswith:
        # Note: Since the Access Mask can have more than once permission we need to add all permutations that include the READ property
        - '1?' # This covers all access masks that are 1 bytes or shorter and the "Read Property" itself
        - '3?' # Read Property + Write Property
        - '4?' # Read Property + Delete Tree
        - '7?' # Read Property + Write Property + Delete Tree
        - '9?' # Read Property + List Object
        - 'B?' # Read Property + Write Property + List Object
        - 'D?' # Read Property + Delete Tree + List Object
        - 'F?' # Covers usage of all possible 2 bytes permissions with any or none of the single byte permissions
filter_main_machine_accounts:
    SubjectUserName|endswith: '$' # Exclude machine accounts
filter_main_msql:
    SubjectUserName|startswith: 'MSOL_' # https://learn.microsoft.com/en-us/azure/active-directory/hybrid/reference-connect-accounts-permissions#ad-ds-connector-account
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Administrators configuring new users.

Tags

• attack.discovery
• attack.t1087.002

MITRE ATT&CK ids this rule names

• T1087.002

References

• https://www.specterops.io/assets/resources/an_ace_up_the_sleeve.pdf
• http://www.stuffithoughtiknew.com/2019/02/detecting-bloodhound.html
• https://learn.microsoft.com/en-us/windows/win32/adschema/attributes-all
• https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4662

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/security/win_security_ad_user_enumeration.yml