Windows Security Event 4662: Non-Machine Account Reads Domain User Object Properties

Alert on AD user property read attempts in Windows Event 4662 from non-machine accounts.

FreeReviewedSigma · Medium · v2

Product: windows
Service: security
Author: Maxime Thiebaut (@0xThiebaut) (SigmaHQ), DRL 1.1
Published: 2020-03-30
Updated: 2026-07-31

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1087.002Domain Account
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows Security auditing events where a non-machine account performs read-oriented access to a domain user object, as indicated by Event ID 4662 with a user-schema object type and matching AccessMask patterns. Such targeted directory reads can enable discovery and enumeration of user objects during reconnaissance. It relies on Security event telemetry (4662) with the accessed object type and access mask fields, while excluding machine accounts and specific connector/service principals to reduce noise.

Reporting behind it

Related detections9 linkedT1087.002 — drag to rearrange

Malicious Domain Group Enumeration via NetSupport remcmdstub

Suspicious Active Directory Reconnaissance via ADExplorer or ADRecon (via process_creation)

Suspicious Service Principal Name Enumeration via Setspn by UAT-8837

Malicious Active Directory Enumeration via SharpHound or BloodHound (via process_creation)

Suspicious Group Discovery - Command (via process_creation)

SharpHound Host Enumeration Over Kerberos (via security)

SPN Enumeration Previous to Kerberoasting Attack - Native Commands (via process_creation)

Suspicious Active Directory Enumeration via AD Explorer Snapshot Process Creation

Malicious Account Added to Domain Admins Group via net Command

Windows Security Event 4662: Non-Machine Account Reads Domain User Object Properties

Pivot detection · T1087.002 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-security-4662-detects-ad-user-object-property-reads-from-non-machine-acc-ab6bffca

title: "Windows Security Event 4662: Non-Machine Account Reads Domain User Object Properties"
id: 7ca11e36-b098-40c2-8579-90a3e3c4dd72
status: test
description: This rule flags Windows Security auditing events where a non-machine account performs read-oriented access to a domain user object, as indicated by Event ID 4662 with a user-schema object type and matching AccessMask patterns. Such targeted directory reads can enable discovery and enumeration of user objects during reconnaissance. It relies on Security event telemetry (4662) with the accessed object type and access mask fields, while excluding machine accounts and specific connector/service principals to reduce noise.
references:
  - https://www.specterops.io/assets/resources/an_ace_up_the_sleeve.pdf
  - http://www.stuffithoughtiknew.com/2019/02/detecting-bloodhound.html
  - https://learn.microsoft.com/en-us/windows/win32/adschema/attributes-all
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4662
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_ad_user_enumeration.yml
author: Maxime Thiebaut (@0xThiebaut), Huntrule Team
date: 2020-03-30
modified: 2022-11-08
tags:
  - attack.discovery
  - attack.t1087.002
logsource:
  product: windows
  service: security
  definition: 'Requirements: The "Read all properties" permission on the user object needs to be audited for the "Everyone" principal'
detection:
  selection:
    EventID: 4662
    ObjectType|contains: bf967aba-0de6-11d0-a285-00aa003049e2
    AccessMask|endswith:
      - 1?
      - 3?
      - 4?
      - 7?
      - 9?
      - B?
      - D?
      - F?
  filter_main_machine_accounts:
    SubjectUserName|endswith: $
  filter_main_msql:
    SubjectUserName|startswith: MSOL_
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Administrators configuring new users.
level: medium
license: DRL-1.1
related:
  - id: ab6bffca-beff-4baa-af11-6733f296d57a
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL