SYSVOL / NETLOGON Enumeration
Every authenticated principal in the domain can read SYSVOL, and SYSVOL routinely stores logon scripts, scheduled-task XML, and GPP files that contain plaintext or reversibly-encrypted credentials. Adversaries recursively enumerate SYSVOL to harvest these — either grepping file contents (Select-String 'password') or matching file names (dir *password*). This rule detects the read-access footprint of that enumeration on the DC itself, independent of the tool or command line used, by counting distinct SYSVOL paths accessed by a single non-machine account in a short window. Default threshold is 100, change to a high volume for your environment
Cortex XDR
