Potential Active Directory User Enumeration From Non-Machine Account
Detects read access to a domain user object from a non-machine account, which can indicate user enumeration activity within Active Directory. The rule specifically looks for Event ID 4662 (An operation was performed on an object) where the ObjectType corresponds to a user object and the AccessMask includes read property permissions. It filters out activity from machine accounts and specific Microsoft Online (MSOL) accounts to reduce false positives.
Sigma
