Detections
Analytics

Enumeration of Local Administrators

low

Language:

Description

The local Administrators group was enumerated with SAMR RPC interface, likely with BloodHound/SharpHound.

See Also

MITRE ATT&CK description

BloodHound tool

SharpHound tool

Indicator Details

Name: Enumeration of Local Administrators

Codename: I-ReconAdminsEnum

Severity: Low

Type: Indicator of Attack

MITRE ATT&CK Information:
ID: T1069.001
Sub-technique of: T1069
Tactic: TA0007