Potential Active Directory Reconnaissance/Enumeration Via LDAP

{
  "generic_search": {
    "EventID": 30,
    "SearchFilter
| contains": [
      "(groupType:1.2.840.113556.1.4.803:=2147483648)",
      "(groupType:1.2.840.113556.1.4.803:=2147483656)",
      "(groupType:1.2.840.113556.1.4.803:=2147483652)",
      "(groupType:1.2.840.113556.1.4.803:=2147483650)",
      "(sAMAccountType=805306369)",
      "(sAMAccountType=805306368)",
      "(sAMAccountType=536870913)",
      "(sAMAccountType=536870912)",
      "(sAMAccountType=268435457)",
      "(sAMAccountType=268435456)",
      "(objectCategory=groupPolicyContainer)",
      "(objectCategory=organizationalUnit)",
      "(objectCategory=nTDSDSA)",
      "(objectCategory=server)",
      "(objectCategory=domain)",
      "(objectCategory=person)",
      "(objectCategory=group)",
      "(objectCategory=user)",
      "(objectClass=trustedDomain)",
      "(objectClass=computer)",
      "(objectClass=server)",
      "(objectClass=group)",
      "(objectClass=user)",
      "(primaryGroupID=521)",
      "(primaryGroupID=516)",
      "(primaryGroupID=515)",
      "(primaryGroupID=512)",
      "Domain Admins",
      "objectGUID=\\*",
      "(schemaIDGUID=\\*)",
      "admincount=1"
    ]
  },
  "distinguished_name_enumeration": {
    "EventID": 30,
    "SearchFilter": "(objectclass=\\*)",
    "DistinguishedName
| contains": [
      "CN=Domain Admins",
      "CN=Enterprise Admins",
      "CN=Group Policy Creator Owners"
    ]
  },
  "suspicious_flag": {
    "EventID": 30,
    "SearchFilter
| contains": [
      "(userAccountControl:1.2.840.113556.1.4.803:=4194304)",
      "(userAccountControl:1.2.840.113556.1.4.803:=2097152)",
      "!(userAccountControl:1.2.840.113556.1.4.803:=1048574)",
      "(userAccountControl:1.2.840.113556.1.4.803:=524288)",
      "(userAccountControl:1.2.840.113556.1.4.803:=65536)",
      "(userAccountControl:1.2.840.113556.1.4.803:=8192)",
      "(userAccountControl:1.2.840.113556.1.4.803:=544)",
      "!(UserAccountControl:1.2.840.113556.1.4.803:=2)",
      "msDS-AllowedToActOnBehalfOfOtherIdentity",
      "msDS-AllowedToDelegateTo",
      "msDS-GroupManagedServiceAccount",
      "(accountExpires=9223372036854775807)",
      "(accountExpires=0)",
      "(adminCount=1)",
      "ms-MCS-AdmPwd"
    ]
  },
  "narrow_down_filter": {
    "EventID": 30,
    "SearchFilter
| contains": [
      "(domainSid=*)",
      "(objectSid=*)"
    ]
  },
  "condition": "(generic_search and not narrow_down_filter) or suspicious_flag or distinguished_name_enumeration"
}