Domain Admins Group Enumerated via SMB

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•2

This rule detects attempts to enumerate the 'Domain Admins' group over SMB (Server Message Block) using the 'NetGroupGetUsers' function. This activity is often associated with reconnaissance by attackers trying to identify high-privilege accounts within a Windows domain.