Query: rule covering Detects potential Active Directory enumeration via LDAP
Matching passage: Sigma rule: Detects potential Active Directory enumeration via LDAP. Logsource: windows / ldap. Rule: title: Potential Active Directory Reconnaissance/Enumeration Via LDAP id: 31d68132-4038-47c7-8f8e-635a39a7c174 status: test description: Detects potential Active Directory enumeration via LDAP references: - https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/hunting-for-reconnaissance-activities-using-ldap-search-filters/ba-p/824726 - https://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/Recon/PowerView.ps1 - https://github.com/BloodHoundAD/SharpHound3/blob/7d96b991b1887ff50349ce59c80980bc0d95c86a/SharpHound3/LdapBuilder.cs - https://medium.com/falconforce/falconfriday-detecting-active-directory-data-collection-0xff21-c22d1a57494c - https://github.com/fox-it/BloodHound.py/blob/d65eb614831cd30f26028ccb072f5e77ca287e0b/bloodhound/ad/domain.py#L427 - https://ipurple.team/2024/07/15/sharphound-detection/ author: Adeem Mawani date: 2021-06-22 modified: 2025-07-04 tags: - attack.discovery - attack.t1069.002 - attack.t1087.002 - attack.t1482 logsource: product: windows service: ldap definition: 'Requirements: Microsoft-Windows-LDAP-Client/Debug ETW logging' detection: generic_search: EventID: 30 SearchFilter|contains: - (groupType:1.2.840.113556.1.4.803:=2147483648) - (groupType:1.2.840.113556.1.4.803:=2147483656) - (groupType:1.2.840.113556.1.4.803:=2147483652) - (groupType:1.2.840.113556.1.4.803:=2147483650) - (sAMAccountType=805306369) - (sAMAccountType=805306368) - (sAMAccountType=536870913) - (sAMAccountType=536870912) - (sAMAccountType=268435457) - (sAMAccountType=268435456) - (objectCategory=groupPolicyContainer) - (objectCategory=organizationalUnit) - (objectCategory=nTDSDSA) - (objectCategory=server) - (objectCategory=domain) - (objectCategory=person) - (objectCategory=group) - (objectCategory=user) - (objectClass=trustedDomain) - (objectClass=computer) - (objectClass=server) - (objectClass=group) - (objectClass=user) - (primaryGroupID=521) - (primaryGroupID=516) - (primaryGroupID=515) - (primaryGroupID=512) - Domain Admins - objectGUID=\* - (schemaIDGUID=\*) - admincount=1 distinguished_name_enumeration: EventID: 30 SearchFilter: (objectclass=\*) DistinguishedName|contains: - CN=Domain Admins - CN=Enterprise Admins - CN=Group Policy Creator Owners suspicious_flag: EventID: 30 SearchFilter|contains: - (userAccountControl:1.2.840.113556.1.4.803:=4194304) - (userAccountControl:1.2.840.113556.1.4.803:=2097152) - '!(userAccountControl:1.2.840.113556.1.4.803:=1048574)' - (userAccountControl:1.2.840.113
Near-miss passage: Sigma rule: Detects DLL sideloading of "dbgcore.dll". Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Of DBGCORE.DLL id: 9ca2bf31-0570-44d8-a543-534c47c33ed7 status: test description: Detects DLL sideloading of "dbgcore.dll" references: - https://hijacklibs.net/ author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research) date: 2022-10-25 modified: 2025-10-06 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \dbgcore.dll filter_main_generic: ImageLoaded|startswith: - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\SoftwareDistribution\ - C:\Windows\System32\ - C:\Windows\SystemTemp\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ filter_optional_steam: ImageLoaded|endswith: \Steam\bin\cef\cef.win7x64\dbgcore.dll filter_optional_opera: ImageLoaded|contains: opera\Opera Installer Temp\opera_package ImageLoaded|endswith: \assistant\dbgcore.dll condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate applications loading their own versions of the DLL mentioned in this rule level: medium