AN1025
Analytic 1025
Windows
Detection of domain group enumeration through command-line utilities such as 'net group /domain' or PowerShell cmdlets, followed by suspicious access to API calls or LSASS memory.
WinEventLog:Security
EventCode=4688
WinEventLog:PowerShell
EventCode=4103, 4104, 4105, 4106
[TimeWindow]
Adjustable window to track chained discovery activity (e.g., 5-10 minutes).
[UserContext]
Tune to focus on non-admin users or service accounts performing enumeration.
[ProcessLineageDepth]
How far back the parent-child process chain is correlated.
AN1026
Analytic 1026
Linux
Behavioral detection of domain group enumeration via ldapsearch or custom scripts leveraging LDAP over the network.
auditd:SYSCALL
execve
linux:syslog
sshd logs
NSM:Flow
ldap.log
[LDAPQueryDepth]
Tunable based on number of LDAP queries before flagging suspicious behavior.
[CommandPattern]
Pattern matching against common ldapsearch or shell enumeration flags.
AN1027
Analytic 1027
macOS
Enumeration of domain groups using dscacheutil or dscl commands, often following initial login or domain trust queries.
macos:unifiedlog
process events
[CommandSignatureThreshold]
Defines how strictly command patterns must match known enumeration syntax.
[TimeWindow]
Adjustable window to correlate chained behavior such as group enumeration followed by user targeting.