Logged-in User Enumeration via Remote SMB

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•4

This rule detects attempts to enumerate logged-in users on a remote system via SMB, specifically looking for the 'NetWkstaUserEnum' string in network traffic. This activity is often associated with discovery tactics used by attackers to gain information about a target environment.