Windows Security Event 4662: Non-Machine Account Reads Domain User Object Properties
Alert on AD user property read attempts in Windows Event 4662 from non-machine accounts.
- Product
- windows
- Service
- security
- Author
- Maxime Thiebaut (@0xThiebaut) (SigmaHQ), DRL 1.1
- Published
- 2020-03-30
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows Security auditing events where a non-machine account performs read-oriented access to a domain user object, as indicated by Event ID 4662 with a user-schema object type and matching AccessMask patterns. Such targeted directory reads can enable discovery and enumeration of user objects during reconnaissance. It relies on Security event telemetry (4662) with the accessed object type and access mask fields, while excluding machine accounts and specific connector/service principals to reduce noise.
Reporting behind it
- specterops.iohttps://www.specterops.io/assets/resources/an_ace_up_the_sleeve.pdf
- stuffithoughtiknew.comhttp://www.stuffithoughtiknew.com/2019/02/detecting-bloodhound.html
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/win32/adschema/attributes-all
- learn.microsoft.comhttps://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4662
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_ad_user_enumeration.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Security Event 4662: Non-Machine Account Reads Domain User Object Properties"
id: 7ca11e36-b098-40c2-8579-90a3e3c4dd72
status: test
description: This rule flags Windows Security auditing events where a non-machine account performs read-oriented access to a domain user object, as indicated by Event ID 4662 with a user-schema object type and matching AccessMask patterns. Such targeted directory reads can enable discovery and enumeration of user objects during reconnaissance. It relies on Security event telemetry (4662) with the accessed object type and access mask fields, while excluding machine accounts and specific connector/service principals to reduce noise.
references:
- https://www.specterops.io/assets/resources/an_ace_up_the_sleeve.pdf
- http://www.stuffithoughtiknew.com/2019/02/detecting-bloodhound.html
- https://learn.microsoft.com/en-us/windows/win32/adschema/attributes-all
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4662
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_ad_user_enumeration.yml
author: Maxime Thiebaut (@0xThiebaut), Huntrule Team
date: 2020-03-30
modified: 2022-11-08
tags:
- attack.discovery
- attack.t1087.002
logsource:
product: windows
service: security
definition: 'Requirements: The "Read all properties" permission on the user object needs to be audited for the "Everyone" principal'
detection:
selection:
EventID: 4662
ObjectType|contains: bf967aba-0de6-11d0-a285-00aa003049e2
AccessMask|endswith:
- 1?
- 3?
- 4?
- 7?
- 9?
- B?
- D?
- F?
filter_main_machine_accounts:
SubjectUserName|endswith: $
filter_main_msql:
SubjectUserName|startswith: MSOL_
condition: selection and not 1 of filter_main_*
falsepositives:
- Administrators configuring new users.
level: medium
license: DRL-1.1
related:
- id: ab6bffca-beff-4baa-af11-6733f296d57a
type: derived