Alias Member Enumeration Attempt

After infiltrating a network, an attacker typically looks for privileged users as their next target. To find these users, an attacker might connect to directory services or accounts to enumerate users, domains, groups, or aliases on the network. Active Directory (AD) is the directory service in a domain-based Windows environment, and every Windows device also has a built-in account database called the Security Account Manager (SAM), which stores local account information. One approach for enumerating members associated with an alias is to send Microsoft Remote Procedure Call (RPC) queries to account databases over the Security Account Manager Remote Protocol (MS-SAMR) interface.