AN0363
Analytic 0363
Windows
Adversary enumeration of domain accounts using net.exe, PowerShell, WMI, or LDAP queries from non-domain controllers or non-admin endpoints.
WinEventLog:Sysmon
EventCode=1
WinEventLog:PowerShell
EventCode=4103, 4104, 4105, 4106
NSM:Flow
LDAP Bind/Search
[CommandLinePattern]
Detect variations of 'net user /domain', 'Get-ADUser', 'Get-ADGroupMember'.
[TimeWindow]
Tune detection for bursts of enumeration commands or search queries.
[SourceHost]
Restrict detection to non-DC or non-admin systems where such commands are unexpected.
AN0364
Analytic 0364
Linux
Domain account enumeration using ldapsearch, samba tools (e.g., 'wbinfo -u'), or winbindd lookups.
auditd:SYSCALL
execve
linuxsyslog
nslcd or winbind logs
NSM:Flow
LDAP Query
[ProcessName]
Detect suspicious use of ldapsearch, wbinfo, getent passwd, or samba enumeration tools.
[LDAPSearchFilter]
Tune for high-volume or broad-scope LDAP queries.
[UserContext]
Apply filters for unexpected users or service accounts executing the behavior.
AN0365
Analytic 0365
macOS
Domain group and user enumeration via dscl or dscacheutil, or queries to directory services from non-admin endpoints.
macos:unifiedlog
Process Execution
macos:unifiedlog
DS daemon log entries
[CommandPattern]
Match patterns such as 'dscl /Active\ Directory/All\ Domains -list /Users'.
[EndpointRole]
Flag this activity only on non-directory hosts or non-admin accounts.