Possible AD User Enumeration From Non-Machine Account (via security)

title: Possible AD User Enumeration From Non-Machine Account (via security)
id: 36aba484-5717-5915-bf07-d14d18c2a217
status: stable
description: This rule detects read access to a domain user from a non-machine account
references:
    - https://attack.mitre.org/techniques/T1087/002/
    - https://www.specterops.io/assets/resources/an_ace_up_the_sleeve.pdf
    - http://www.stuffithoughtiknew.com/2019/02/detecting-bloodhound.html
    - https://learn.microsoft.com/en-us/windows/win32/adschema/attributes-all
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4662
author: Huntrule Team
date: 2026-03-07
tags:
    - attack.discovery
    - attack.t1087.002
logsource:
    product: windows
    service: security
    definition: 'Requirements: The "Read all properties" permission on the user object needs to be audited for the "Everyone" principal'
detection:
    selection:
        EventID: 4662
        ObjectType|contains: 'bf967aba-0de6-11d0-a285-00aa003049e2'
        AccessMask|endswith:
            - '1?'
            - '3?'
            - '4?'
            - '7?'
            - '9?'
            - 'B?'
            - 'D?'
            - 'F?'
    filter_main_machine_accounts:
        SubjectUserName|endswith: '$'
    filter_main_msql:
        SubjectUserName|startswith: 'MSOL_'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium