Analytics
Informational
✕
A user executed multiple LDAP enumeration queries
A user executed multiple LDAP enumeration queries.
- Module:
- Identity Analytics
- Data source:
- XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Discovery (TA0007)
ATT&CK techniques: Account Discovery (T1087) Permission Groups Discovery: Domain Groups (T1069.002) Domain Trust Discovery (T1482) Remote System Discovery (T1018) System Network Configuration Discovery (T1016)
Detector tags: LDAP Analytics (Server)
Attacker's goals:
An adversary may utilize the LDAP protocol to gain information on the Active Directory environment and plan its lateral movement over the network.
Investigative actions:
Where possible, check the legitimacy of the process that executed these LDAP queries. Investigate the LDAP search query for any suspicious indicators. Determine whether the search query is generic, those search queries (often using wildcards) tend to be more suspicious.
- Test period:
- 10 Minutes
- Deduplication:
- 1 Day
1 variation:
- A user executed suspicious LDAP enumeration queries Low (parent: Informational)