Event banner
Event details
Recently I received an alert about "Account enumeration reconnaissance" with an unknown resource name. That enumeration was through NTLM against my DC, with destination to my Exchange Server. Besides, the resource has no information about IP, logged users, accessed resources, and so on. My question is: What should I start to block that kind of resource with no information in MDI?
The application making the NTLM request can put in what it wants as the computer name. When MDI has access to event 8004 on the domain controller, it will add the resource that was being accessed to the Account Enumeration alert. Now you can look on the resource computer for event 4624 and 4625 to see the source IP address of the computer connecting to the resource. https://docs.microsoft.com/en-us/defender-for-identity/reconnaissance-alerts#account-enumeration-reconnaissance-external-id-2003
Make sure that the domain controllers are configured to record event 8004. https://docs.microsoft.com/en-us/defender-for-identity/configure-windows-event-collection#event-id-8004