Suspicious LDAP Attributes Used by LDAPFragger

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•45

Detects the usage of specific LDAP attributes ('primaryInternationalISDNNumber', 'otherFacsimileTelephoneNumber', 'primaryTelexNumber') that are known to be used by the LDAPFragger tool for data exchange via LDAP. These attributes are generally not commonly used in enterprise environments, making their appearance suspicious and indicative of potential Command and Control activity.