{"id":"31d68132-4038-47c7-8f8e-635a39a7c174","title":"Potential Active Directory Reconnaissance/Enumeration Via LDAP","description":"Detects potential Active Directory enumeration via LDAP","author":"Adeem Mawani","status":"test","level":"medium","date":"2021-06-22","modified":"2025-07-04","tags":["attack.discovery","attack.t1069.002","attack.t1087.002","attack.t1482"],"technique_ids":["T1069.002","T1087.002","T1482"],"logsource":{"product":"windows","service":"ldap","definition":"Requirements: Microsoft-Windows-LDAP-Client/Debug ETW logging"},"falsepositives":[],"references":["https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/hunting-for-reconnaissance-activities-using-ldap-search-filters/ba-p/824726","https://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/Recon/PowerView.ps1","https://github.com/BloodHoundAD/SharpHound3/blob/7d96b991b1887ff50349ce59c80980bc0d95c86a/SharpHound3/LdapBuilder.cs","https://medium.com/falconforce/falconfriday-detecting-active-directory-data-collection-0xff21-c22d1a57494c","https://github.com/fox-it/BloodHound.py/blob/d65eb614831cd30f26028ccb072f5e77ca287e0b/bloodhound/ad/domain.py#L427","https://ipurple.team/2024/07/15/sharphound-detection/"],"source_path":"rules/windows/builtin/ldap/win_ldap_recon.yml","source_sha256":"f4e58a8b7e35104eca0ee7592129bfb796b84145552871634cea75b785c440af","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/ldap/win_ldap_recon.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Active Directory Reconnaissance/Enumeration Via LDAP\nid: 31d68132-4038-47c7-8f8e-635a39a7c174\nstatus: test\ndescription: Detects potential Active Directory enumeration via LDAP\nreferences:\n    - https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/hunting-for-reconnaissance-activities-using-ldap-search-filters/ba-p/824726\n    - https://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/Recon/PowerView.ps1\n    - https://github.com/BloodHoundAD/SharpHound3/blob/7d96b991b1887ff50349ce59c80980bc0d95c86a/SharpHound3/LdapBuilder.cs\n    - https://medium.com/falconforce/falconfriday-detecting-active-directory-data-collection-0xff21-c22d1a57494c\n    - https://github.com/fox-it/BloodHound.py/blob/d65eb614831cd30f26028ccb072f5e77ca287e0b/bloodhound/ad/domain.py#L427\n    - https://ipurple.team/2024/07/15/sharphound-detection/\nauthor: Adeem Mawani\ndate: 2021-06-22\nmodified: 2025-07-04\ntags:\n    - attack.discovery\n    - attack.t1069.002\n    - attack.t1087.002\n    - attack.t1482\nlogsource:\n    product: windows\n    service: ldap\n    definition: 'Requirements: Microsoft-Windows-LDAP-Client/Debug ETW logging'\ndetection:\n    generic_search:\n        EventID: 30\n        SearchFilter|contains:\n            - '(groupType:1.2.840.113556.1.4.803:=2147483648)'\n            - '(groupType:1.2.840.113556.1.4.803:=2147483656)'\n            - '(groupType:1.2.840.113556.1.4.803:=2147483652)'\n            - '(groupType:1.2.840.113556.1.4.803:=2147483650)'\n            - '(sAMAccountType=805306369)'\n            - '(sAMAccountType=805306368)'\n            - '(sAMAccountType=536870913)'\n            - '(sAMAccountType=536870912)'\n            - '(sAMAccountType=268435457)'\n            - '(sAMAccountType=268435456)'\n            - '(objectCategory=groupPolicyContainer)'\n            - '(objectCategory=organizationalUnit)'\n            # - '(objectCategory=Computer)' Prone to false positives\n            - '(objectCategory=nTDSDSA)'\n            - '(objectCategory=server)'\n            - '(objectCategory=domain)'\n            - '(objectCategory=person)'\n            - '(objectCategory=group)'\n            - '(objectCategory=user)'\n            - '(objectClass=trustedDomain)'\n            - '(objectClass=computer)'\n            - '(objectClass=server)'\n            - '(objectClass=group)'\n            - '(objectClass=user)'\n            - '(primaryGroupID=521)'\n            - '(primaryGroupID=516)'\n            - '(primaryGroupID=515)'\n            - '(primaryGroupID=512)'\n            - 'Domain Admins'\n            - 'objectGUID=\\*'\n            - '(schemaIDGUID=\\*)'\n            - 'admincount=1'\n    distinguished_name_enumeration:\n        EventID: 30\n        SearchFilter: '(objectclass=\\*)'\n        DistinguishedName|contains:\n            - 'CN=Domain Admins'\n            - 'CN=Enterprise Admins'\n            - 'CN=Group Policy Creator Owners'\n    suspicious_flag:\n        EventID: 30\n        SearchFilter|contains:\n            - '(userAccountControl:1.2.840.113556.1.4.803:=4194304)'\n            - '(userAccountControl:1.2.840.113556.1.4.803:=2097152)'\n            - '!(userAccountControl:1.2.840.113556.1.4.803:=1048574)'\n            - '(userAccountControl:1.2.840.113556.1.4.803:=524288)'\n            - '(userAccountControl:1.2.840.113556.1.4.803:=65536)'\n            - '(userAccountControl:1.2.840.113556.1.4.803:=8192)'\n            - '(userAccountControl:1.2.840.113556.1.4.803:=544)'\n            - '!(UserAccountControl:1.2.840.113556.1.4.803:=2)'\n            - 'msDS-AllowedToActOnBehalfOfOtherIdentity'\n            - 'msDS-AllowedToDelegateTo'\n            - 'msDS-GroupManagedServiceAccount'\n            - '(accountExpires=9223372036854775807)'\n            - '(accountExpires=0)'\n            - '(adminCount=1)'\n            - 'ms-MCS-AdmPwd'\n    narrow_down_filter:\n        EventID: 30\n        SearchFilter|contains:\n            - '(domainSid=*)'\n            - '(objectSid=*)'\n    condition: (generic_search and not narrow_down_filter) or suspicious_flag or distinguished_name_enumeration\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1069.002","id":"T1069.002","name":"Domain Groups","page":"techniques/enterprise/T1069.002/"},{"key":"enterprise/T1087.002","id":"T1087.002","name":"Domain Account","page":"techniques/enterprise/T1087.002/"},{"key":"enterprise/T1482","id":"T1482","name":"Domain Trust Discovery","page":"techniques/enterprise/T1482/"}],"data_path":"data/detection-rules/31d68132-4038-47c7-8f8e-635a39a7c174.json","kind":"sigma"}