Elastic Defend high stable eql

Domain Accounts Enumeration via LDAP Search

Identifies a list of suspicious LDAP queries often used by reconnaissance tools to enumerate domain user accounts.

View Source

Detection Logic

api where process.Ext.api.name == "ldap_search" and not user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
 not process.executable :
             ("?:\\Program Files\\Azure Advanced Threat Protection Sensor\\*\\Microsoft.Tri.Sensor.exe",
              "?:\\Windows\\ADFS\\Microsoft.IdentityServer.ServiceHost.exe") and
 process.Ext.api.parameters.search_filter : (
  "(&(samAccountType=805306368)(samAccountName=?)",
  "(&(objectCategory=person)(lastLogon>=*",
  "(&(objectCategory=person)(objectClass=user)(lastLogon>=*",
  "(&(objectCategory=person)(objectClass=user)(directReports=?)(!(manager=?)))"
 )

Field Validations

Loading…

Comments (0)

Loading comments...