Session Enumeration (Account Discovery)

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•2

Detects inbound RPC calls to the Server Service interface using operation number 12 (NetrSessionEnum), which may indicate remote session enumeration for account discovery and reconnaissance.