New Tool Release - RPC_ENUM - RID Cycling Attack
ID: 6c45f50a-9edf-55ad-9254-d54de0527cf8
STIX ID: report--6c45f50a-9edf-55ad-9254-d54de0527cf8
Feed Name: TrustedSec blog
Threat Score
The document explains how to perform null session enumeration against Windows/Active Directory systems by establishing unauthenticated RPC connections (rpcclient -U "" -N), using lsaquery to obtain the domain SID, cycling RIDs (e.g., 500–10000) with lookupsids/lookupnames to enumerate accounts, and describes an automated Python tool (rid_enum/ridenum) that automates RID cycling and optional password brute-forcing (requires python-pexpect).
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.