Elastic Defend high stable eql

Domain Computers Enumeration via LDAP Search

Identifies a list of suspicious LDAP queries often used by reconnaissance tools to enumerate domain computers.

View Source

Detection Logic

api where process.Ext.api.name == "ldap_search" and user.id != "S-1-5-18" and
 not process.executable :
             ("?:\\Program Files\\Azure Advanced Threat Protection Sensor\\*\\Microsoft.Tri.Sensor.exe",
              "?:\\Windows\\ADFS\\Microsoft.IdentityServer.ServiceHost.exe") and
 process.Ext.api.parameters.search_filter : (
  "(&(objectCategory=computer)(operatingSystem=?server?))",
  "(&(sAMAccountType=805306369)(dnshostname=?))",
  "(&(objectCategory=computer)(lastLogon>=*)(operatingSystem=*windows*))",
  "(&(objectCategory=computer)(lastLogonTimestamp<=133000000000000000))",
  "(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=524288))",
  "(&(objectCategory=Computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))",
  "*(&(objectclass=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))*",
  "(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192)",
  "(&(objectclass=computer)(userAccountControl&8192))",
  "(&(&(&(&(samAccountType=805306369)(!(primaryGroupId=516)))(objectCategory=computer)(operatingSystem=Windows Server?))))",
  "(&(objectCategory=computer)(operatingSystem=?server?)(!(userAccountControl:1.2.840.113556.1.4.803:=8192)))"
 ) and 
 not (process.code_signature.subject_name in ("Specops Software Inc.", "Azul Systems, Inc.") and process.code_signature.trusted == true)

Field Validations

Loading…

Comments (0)

Loading comments...