Analytics
Low
✕
Rare LDAP enumeration
Possible LDAP enumeration with a rare combination of queries.
- Module:
- Platform Analytics
- Data source:
- Palo Alto Networks Firewall EAL Logs
ATT&CK tactics: Discovery (TA0007)
ATT&CK techniques: Account Discovery (T1087)
Detector tags: LDAP Analytics
Attacker's goals:
An adversary may utilize the LDAP protocol to gain information on the Active Directory environment and plan its lateral movement over the network.
Investigative actions:
Where possible, check the legitimacy of the process that executed these LDAP queries. Investigate the LDAP search query for any suspicious indicators. Determine whether the search query is generic, those search queries (often using wildcards) tend to be more suspicious.
- Test period:
- 10 Minutes
- Deduplication:
- 1 Day