AN1612
Analytic 1612
Windows
Detection of processes performing local or domain account enumeration by invoking account directory queries or security APIs followed by structured output of account lists. The defender observes command execution or API invocation patterns that retrieve account information and produce enumeration artifacts shortly afterward.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Security
EventCode=4688
WinEventLog:Security
EventCode=4798, 4799
[CommandLinePattern]
Match variations in enumeration commands like 'net user', 'Get-ADUser', 'dsquery'.
[TimeWindow]
Short burst of account enumeration commands may indicate automation.
[UserContext]
Restrict to non-admin accounts or unexpected users executing enumeration commands.
AN1613
Analytic 1613
Linux
Enumeration of users and groups through suspicious shell commands or unauthorized access to /etc/passwd or /etc/shadow.
auditd:SYSCALL
PATH
linux:Sysmon
EventCode=1
[AccessedFile]
Tune based on file paths such as '/etc/passwd', '/etc/group', '/etc/shadow'.
[ParentProcessName]
Filter known admin processes to reduce false positives.
AN1614
Analytic 1614
macOS
Detection of account enumeration through directory service queries or system utilities accessing account metadata stores, followed by structured enumeration output.
macos:unifiedlog
process event
macos:unifiedlog
DirectoryService queries retrieving account information
[CommandLine]
Tune for dscl -list, dscacheutil -q user, id -un, etc.
[ExecutionContext]
Alert if enumeration is performed in non-console session or by unusual users.
AN1615
Analytic 1615
IaaS
Detection of enumeration of identity entities through cloud provider APIs where principals retrieve account metadata such as IAM users or roles in rapid succession.
AWS:CloudTrail
DescribeUsers / ListUsers / GetUser
[API_Method]
Tune based on which IAM APIs are used and their frequency.
[CallerType]
Differentiate user-initiated from automated/scripted enumeration.
AN1616
Analytic 1616
Identity Provider
Detection of identity directory enumeration through API calls or administrative queries retrieving multiple account objects within a short interval.
azure:signinlogs
Graph API Query
saas:okta
User Enumeration Events
[QueryType]
Detect user vs role enumeration. Tune based on query scope.
[AppContext]
Correlate enumeration with unexpected app registrations or identities.
AN1617
Analytic 1617
ESXi
Detection of enumeration activity when system processes query ESXi host account configuration or management APIs to retrieve user account listings.
esxi:vpxd
vCenter Management
[CommandPattern]
Tune based on known enumeration commands: 'vim-cmd vimsvc/auth/userlist'.
[PrivilegedSession]
Elevated enumeration from vpxuser or root may indicate threat activity.
AN1618
Analytic 1618
SaaS
Account enumeration via bulk access to user directory features or hidden APIs.
gcp:audit
Directory API Access
[EndpointURL]
Tune based on enumeration from directory endpoints such as /users, /groups.
[UserAgent]
Detect scripted enumeration via curl/wget or unknown tools.
AN1619
Analytic 1619
Office Suite
Account discovery via VBA macros, COM objects, or embedded scripting.
m365:unified
Scripted Activity
[MacroName]
Alert on auto-running macros accessing directory or user info.
[ExecutionScope]
Focus on macros invoking LDAP, ADODB, or WMI queries.