SAMR User and Domain Enumeration via RPC

Lacey Cochrane@NullVectorX

•updated 29 days ago•34•0•5

Detects high-volume usage of SAMR RPC functions (SamrEnumerateUsersInDomain, SamrLookupNamesInDomain, SamrQueryInformationUser) used to enumerate domain users and account attributes. This behavior is indicative of reconnaissance activities performed by tools such as secretsdump, BloodHound, and NetExec.