Elastic Defend high stable eql

Privileged Domain Group Enumeration via LDAP

Identifies Active Directory privileged groups enumeration using LDAP search events. Adversaries attempt to enumerate groups with sensitive permissions to further escalate privileges.

View Source

Detection Logic

api where process.Ext.api.name == "ldap_search" and
 (
 (process.Ext.api.parameters.search_filter : ("objectClass=?", "(objectClass=?)") and
  process.Ext.api.parameters.distinguished_name :
                            ("cn=domain admins*", "cn=enterprise admins*", "cn=dnsadmins*", "cn=cloneable domain controllers",
                             "cn=read-only domain controllers", "cn=exchange organization administrators*",
                             "cn=backup admins*", "cn=group policy creator owners*", "cn=domain controllers*")) or
  (process.Ext.api.parameters.search_filter : "*(objectClass=user)(memberof*" and process.Ext.api.parameters.search_filter : "*Admin*")
  ) and
  not process.executable : "C:\\Program Files\\Semperis\\Management Server\\Semperis.TaskServerSvcHost.exe"

Field Validations

Loading…

Comments (0)

Loading comments...