Query: Sigma rule for Detects potential Active Directory enumeration via LDAP
Matching passage: Sigma rule: Detects potential Active Directory enumeration via LDAP. Logsource: windows / ldap. Rule: title: Potential Active Directory Reconnaissance/Enumeration Via LDAP id: 31d68132-4038-47c7-8f8e-635a39a7c174 status: test description: Detects potential Active Directory enumeration via LDAP references: - https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/hunting-for-reconnaissance-activities-using-ldap-search-filters/ba-p/824726 - https://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/Recon/PowerView.ps1 - https://github.com/BloodHoundAD/SharpHound3/blob/7d96b991b1887ff50349ce59c80980bc0d95c86a/SharpHound3/LdapBuilder.cs - https://medium.com/falconforce/falconfriday-detecting-active-directory-data-collection-0xff21-c22d1a57494c - https://github.com/fox-it/BloodHound.py/blob/d65eb614831cd30f26028ccb072f5e77ca287e0b/bloodhound/ad/domain.py#L427 - https://ipurple.team/2024/07/15/sharphound-detection/ author: Adeem Mawani date: 2021-06-22 modified: 2025-07-04 tags: - attack.discovery - attack.t1069.002 - attack.t1087.002 - attack.t1482 logsource: product: windows service: ldap definition: 'Requirements: Microsoft-Windows-LDAP-Client/Debug ETW logging' detection: generic_search: EventID: 30 SearchFilter|contains: - (groupType:1.2.840.113556.1.4.803:=2147483648) - (groupType:1.2.840.113556.1.4.803:=2147483656) - (groupType:1.2.840.113556.1.4.803:=2147483652) - (groupType:1.2.840.113556.1.4.803:=2147483650) - (sAMAccountType=805306369) - (sAMAccountType=805306368) - (sAMAccountType=536870913) - (sAMAccountType=536870912) - (sAMAccountType=268435457) - (sAMAccountType=268435456) - (objectCategory=groupPolicyContainer) - (objectCategory=organizationalUnit) - (objectCategory=nTDSDSA) - (objectCategory=server) - (objectCategory=domain) - (objectCategory=person) - (objectCategory=group) - (objectCategory=user) - (objectClass=trustedDomain) - (objectClass=computer) - (objectClass=server) - (objectClass=group) - (objectClass=user) - (primaryGroupID=521) - (primaryGroupID=516) - (primaryGroupID=515) - (primaryGroupID=512) - Domain Admins - objectGUID=\* - (schemaIDGUID=\*) - admincount=1 distinguished_name_enumeration: EventID: 30 SearchFilter: (objectclass=\*) DistinguishedName|contains: - CN=Domain Admins - CN=Enterprise Admins - CN=Group Policy Creator Owners suspicious_flag: EventID: 30 SearchFilter|contains: - (userAccountControl:1.2.840.113556.1.4.803:=4194304) - (userAccountControl:1.2.840.113556.1.4.803:=2097152) - '!(userAccountControl:1.2.840.113556.1.4.803:=1048574)' - (userAccountControl:1.2.840.113
Near-miss passage: Sigma rule: Detects the enabling of the PowerShell script execution policy. Once enabled, this policy allows scripts to be executed.. Logsource: windows / registry_set. Rule: title: PowerShell Script Execution Policy Enabled id: 8218c875-90b9-42e2-b60d-0b0069816d10 related: - id: fad91067-08c5-4d1a-8d8c-d96a21b37814 type: derived status: test description: Detects the enabling of the PowerShell script execution policy. Once enabled, this policy allows scripts to be executed. references: - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.PowerShell::EnableScripts author: Nasreddine Bencherchali (Nextron Systems), Thurein Oo date: 2023-10-18 tags: - attack.execution logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Policies\Microsoft\Windows\PowerShell\EnableScripts Details: DWORD (0x00000001) condition: selection falsepositives: - Likely level: low