Password Spraying Enumeration via LDAP

api where process.Ext.api.name == "ldap_search" and user.id != "S-1-5-18" and
 not process.executable :
             ("?:\\Program Files\\Azure Advanced Threat Protection Sensor\\*\\Microsoft.Tri.Sensor.exe",
              "?:\\Windows\\ADFS\\Microsoft.IdentityServer.ServiceHost.exe",
              "?:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe",
              "?:\\Program Files (x86)\\Trend Micro\\Security Agent\\PccNTMon.exe",
              "?:\\Program Files\\Microsoft SQL Server\\MSSQL??.MSSQLSERVER\\MSSQL\\Binn\\sqlservr.exe") and
 process.Ext.api.parameters.search_filter : (
  // Enabled accounts
  "(&(objectCategory=person)(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))",
  "(&(objectCategory=Computer)(!userAccountControl:1.2.840.113556.1.4.803:=2))",

  // Password never set / reset conditions
  "(&(objectCategory=person)(objectClass=user)*(pwdLastSet=0))",
  "(&(objectCategory=person)(objectClass=user)*(pwdLastSet>=129473172000000000))",

  // Weak password policy accounts
  "(&(objectCategory=person)(objectClass=user)*(userAccountControl:1.2.840.113556.1.4.803:=65536))", // PASSWD_NEVER_EXPIRES
  "(&(objectCategory=person)(objectClass=user)*(userAccountControl:1.2.840.113556.1.4.803:=32))",    // PASSWD_NOTREQD

  // Spray candidate filters
  "(&(samAccountType=805306368)(
| (homeDirectory=?)(scriptPath=*)(profilePath=?)))",
  "(&(objectCategory=person)(objectClass=user)(directReports=?)(!(manager=?)))"
 )