Forum Discussion
Solved
Account enumeration reconnaissance from an unresolved computer.
Hi, we are getting an alert about account enumeration reconnaissance on our network. It says "an actor on MSTSC performed suspicious account enumeration exposing 2 existing account names." This enume...
It happens if the connection was attempted via RDP.
It's a protocol limitation, in the NTLM event, this is what the protocol is putting in the machine name field, and there is no IP address in this event.
I think this post can give hints on it:
EliOfek
Microsoft
MicrosoftIt happens if the connection was attempted via RDP.
It's a protocol limitation, in the NTLM event, this is what the protocol is putting in the machine name field, and there is no IP address in this event.
I think this post can give hints on it:
