{"id":"a21bcd7e-38ec-49ad-b69a-9ea17e69509e","title":"DNS Server Discovery Via LDAP Query","description":"Detects DNS server discovery via LDAP query requests from uncommon applications","author":"frack113","status":"test","level":"low","date":"2022-08-20","modified":"2023-09-18","tags":["attack.discovery","attack.t1482"],"technique_ids":["T1482"],"logsource":{"product":"windows","category":"dns_query"},"falsepositives":["Likely"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/980f3f83fd81f37c1ca9c02dccfd1c3d9f9d0841/atomics/T1016/T1016.md#atomic-test-9---dns-server-discovery-using-nslookup","https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/7fcdce70-5205-44d6-9c3a-260e616a2f04"],"source_path":"rules/windows/dns_query/dns_query_win_dns_server_discovery_via_ldap_query.yml","source_sha256":"ac4c207dbcfbd2b449d7397256cd4a279f1da27fa2e85cd6192c8f841eefb68e","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/dns_query/dns_query_win_dns_server_discovery_via_ldap_query.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: DNS Server Discovery Via LDAP Query\nid: a21bcd7e-38ec-49ad-b69a-9ea17e69509e\nstatus: test\ndescription: Detects DNS server discovery via LDAP query requests from uncommon applications\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/980f3f83fd81f37c1ca9c02dccfd1c3d9f9d0841/atomics/T1016/T1016.md#atomic-test-9---dns-server-discovery-using-nslookup\n    - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/7fcdce70-5205-44d6-9c3a-260e616a2f04\nauthor: frack113\ndate: 2022-08-20\nmodified: 2023-09-18\ntags:\n    - attack.discovery\n    - attack.t1482\nlogsource:\n    product: windows\n    category: dns_query\ndetection:\n    selection:\n        QueryName|startswith: '_ldap.'\n    filter_main_generic:\n        Image|contains:\n            - ':\\Program Files\\'\n            - ':\\Program Files (x86)\\'\n            - ':\\Windows\\'\n    filter_main_defender:\n        Image|contains: ':\\ProgramData\\Microsoft\\Windows Defender\\Platform\\'\n        Image|endswith: '\\MsMpEng.exe'\n    filter_main_unknown:\n        Image: '<unknown process>'\n    filter_optional_azure:\n        Image|startswith: 'C:\\WindowsAzure\\GuestAgent'\n    filter_main_null:\n        Image: null\n    filter_optional_browsers:\n        # Note: This list is for browsers installed in the user context. To avoid basic evasions based on image name. Best to baseline this list with the browsers you use internally and add their full paths.\n        Image|endswith:\n            - '\\chrome.exe'\n            - '\\firefox.exe'\n            - '\\opera.exe'\n    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Likely\n# Note: Incrase the level once a baseline is established\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1482","id":"T1482","name":"Domain Trust Discovery","page":"techniques/enterprise/T1482/"}],"data_path":"data/detection-rules/a21bcd7e-38ec-49ad-b69a-9ea17e69509e.json","kind":"sigma"}