mdecrevoisier high experimental sigma

Active Directory honeypot enumerated by a suspicious host (Bloodhound)

Detects scenarios where an attacker is attempting to discover sensitive accounts using tools like Bloodhound. To find out the source of the enumeration, correlate the SubjectLogonId from ID 4662 with TargetLogonId from ID 4624.

View Source

Detection Logic

{
  "selection": {
    "EventID": 4662,
    "ObjectName": "%honeypot_guid_list%"
  },
  "condition": "selection"
}

False Positives

  • ⚠ LDAP explorer tools, pentest

Field Validations

Loading…

Comments (0)

Loading comments...