Potential AD User Enumeration From Non-Machine Account — Detection Rule

Detects read access to a domain user from a non-machine account

Read the full analysis on IntelFusions