Query: write Sigma for Detects potential Active Directory enumeration via LDAP
Matching passage: Sigma rule: Detects potential Active Directory enumeration via LDAP. Logsource: windows / ldap. Rule: title: Potential Active Directory Reconnaissance/Enumeration Via LDAP id: 31d68132-4038-47c7-8f8e-635a39a7c174 status: test description: Detects potential Active Directory enumeration via LDAP references: - https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/hunting-for-reconnaissance-activities-using-ldap-search-filters/ba-p/824726 - https://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/Recon/PowerView.ps1 - https://github.com/BloodHoundAD/SharpHound3/blob/7d96b991b1887ff50349ce59c80980bc0d95c86a/SharpHound3/LdapBuilder.cs - https://medium.com/falconforce/falconfriday-detecting-active-directory-data-collection-0xff21-c22d1a57494c - https://github.com/fox-it/BloodHound.py/blob/d65eb614831cd30f26028ccb072f5e77ca287e0b/bloodhound/ad/domain.py#L427 - https://ipurple.team/2024/07/15/sharphound-detection/ author: Adeem Mawani date: 2021-06-22 modified: 2025-07-04 tags: - attack.discovery - attack.t1069.002 - attack.t1087.002 - attack.t1482 logsource: product: windows service: ldap definition: 'Requirements: Microsoft-Windows-LDAP-Client/Debug ETW logging' detection: generic_search: EventID: 30 SearchFilter|contains: - (groupType:1.2.840.113556.1.4.803:=2147483648) - (groupType:1.2.840.113556.1.4.803:=2147483656) - (groupType:1.2.840.113556.1.4.803:=2147483652) - (groupType:1.2.840.113556.1.4.803:=2147483650) - (sAMAccountType=805306369) - (sAMAccountType=805306368) - (sAMAccountType=536870913) - (sAMAccountType=536870912) - (sAMAccountType=268435457) - (sAMAccountType=268435456) - (objectCategory=groupPolicyContainer) - (objectCategory=organizationalUnit) - (objectCategory=nTDSDSA) - (objectCategory=server) - (objectCategory=domain) - (objectCategory=person) - (objectCategory=group) - (objectCategory=user) - (objectClass=trustedDomain) - (objectClass=computer) - (objectClass=server) - (objectClass=group) - (objectClass=user) - (primaryGroupID=521) - (primaryGroupID=516) - (primaryGroupID=515) - (primaryGroupID=512) - Domain Admins - objectGUID=\* - (schemaIDGUID=\*) - admincount=1 distinguished_name_enumeration: EventID: 30 SearchFilter: (objectclass=\*) DistinguishedName|contains: - CN=Domain Admins - CN=Enterprise Admins - CN=Group Policy Creator Owners suspicious_flag: EventID: 30 SearchFilter|contains: - (userAccountControl:1.2.840.113556.1.4.803:=4194304) - (userAccountControl:1.2.840.113556.1.4.803:=2097152) - '!(userAccountControl:1.2.840.113556.1.4.803:=1048574)' - (userAccountControl:1.2.840.113
Near-miss passage: Sigma rule: Detects execution of ntdsutil.exe, which can be used for various attacks against the NTDS database (NTDS.DIT). Logsource: windows / process_creation. Rule: title: Invocation of Active Directory Diagnostic Tool (ntdsutil.exe) id: 2afafd61-6aae-4df4-baed-139fa1f4c345 status: test description: Detects execution of ntdsutil.exe, which can be used for various attacks against the NTDS database (NTDS.DIT) references: - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/ntdsutil.htm author: Thomas Patzke date: 2019-01-16 modified: 2022-03-11 tags: - attack.credential-access - attack.t1003.003 logsource: category: process_creation product: windows detection: selection: Image|endswith: \ntdsutil.exe condition: selection falsepositives: - NTDS maintenance level: medium