This note documents detection patterns related to RID Cycling within Active Directory environments.

Direct Indicators

Log	Event ID	Meaning	Forensic Value	Notes
Security	4624	Successful logon	Low	Authentication event before enumeration activity.
Security	4776	NTLM authentication	Medium	RID cycling often uses NTLM-based queries against domain controllers.
Security	4662	Operation performed on object	High	LDAP queries against user or group objects may trigger object access auditing.
Sysmon	3	Network connection	High	Connections to domain controllers via SMB (445) or LDAP (389/636).
Sysmon	1	Process creation	Medium	Execution of tools performing RID enumeration.

Indirect Indicators

Indicator	What To Look For	Forensic Value	Notes
Sequential RID queries	Enumeration of SIDs with incremental RID values	Critical	Classic indicator of RID cycling.
Large number of user lookups	High volume account discovery requests	High	Attackers mapping domain users.
SMB queries to domain controller	Frequent requests to SAMR or LSARPC endpoints	High	Typical mechanism used for RID enumeration.
Enumeration from workstation	RID queries originating from non-admin system	High	Suspicious reconnaissance behavior.
Execution of enumeration tools	Processes like rpcclient or CrackMapExec	Critical	Direct evidence of enumeration activity.

Common Tools

Tool	Usage
rpcclient	Enumerates domain users via RID cycling.
CrackMapExec	Automates RID enumeration across domains.
Impacket samrdump.py	Enumerates accounts using SAMR protocol.
enum4linux	Performs SMB-based user enumeration.
Nmap smb-enum-users	Enumerates users through SMB scripts.

Relevant Artifacts

Domain controller Security logs (4662)
SMB / RPC network telemetry
Sysmon logs (1, 3)
EDR telemetry identifying enumeration tools
Prefetch artifacts for rpcclient or enum4linux
Network scanning telemetry
Authentication logs preceding enumeration
SAMR / LSARPC traffic logs

MITRE ATT&CK References

T1087 Account Discovery
T1018 Remote System Discovery

Decision Tree

Is the suspicious event present?
- Identify enumeration patterns in SMB or LDAP queries.
What host generated the event?
- Determine workstation performing RID queries.
Is the account expected to perform this action?
- Investigate whether account normally enumerates directory objects.
Pivot:
- Source host → inspect execution of rpcclient, CrackMapExec, or enum4linux.
- Network → analyze SMB / RPC traffic to domain controllers.
- Enumeration results → determine which accounts were discovered.
Confirm exploitation
- Determine whether attacker mapped domain accounts using RID cycling.

Example Detection Templates

KQL

DeviceNetworkEvents
| where RemotePort in (445,389)
| summarize count() by InitiatingProcessAccountName, RemoteIP, bin(TimeGenerated,5m)

SecurityEvent
| where EventID == 4662
| summarize count() by SubjectUserName, bin(TimeGenerated,5m)

EQL

any where event.code == "4662"

Sigma

title: Suspicious RID Enumeration Activity
id: rid-cycling-detection
status: experimental
description: Detects account discovery attempts via RID enumeration
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4662
  condition: selection
fields:
  - SubjectUserName
  - ObjectName
falsepositives:
  - Legitimate administrative enumeration
level: medium
tags:
  - attack.discovery
  - attack.t1087

Mitigation & Hardening

Control Area	Mitigation	Effectiveness	Notes
Network controls	Restrict anonymous SMB enumeration	High	Prevents unauthorized RID queries.
Monitoring	Alert on repeated SAMR / RPC queries	High	Detects enumeration activity.
Least privilege	Limit access to domain enumeration interfaces	Medium	Reduces reconnaissance surface.
EDR monitoring	Detect rpcclient or enum4linux execution	High	Direct detection of attacker tools.
Threat hunting	Review network scanning patterns regularly	Medium	Identifies abnormal discovery activity.