New User Session Enumeration Attempt

After infiltrating a network, an attacker typically looks for privileged users as their next target. To find these users, an attacker might connect to directory services or accounts to enumerate users, administrators, domains, or groups on the network. Active Directory (AD) is the directory service in a domain-based Windows environment.

One approach for enumerating user sessions is to send a Microsoft remote procedure call (RPC). The attacker sends a request to run the enumeration procedure on a server. The request includes an RPC interface (srvsvc) and operation (NetrSessionEnum) that delivers the procedure call to the victim through inter-process communication. After running the procedure, the victim sends a response that delivers the results to the attacker. The session information includes IP addresses, usernames, and workstation names of clients connected to the victim.