DNS Server Discovery Via LDAP Query from Uncommon Application
This rule detects attempts to discover DNS servers within a network using LDAP queries. Specifically, it looks for DNS queries where the query name starts with '_ldap.' and the query originates from an uncommon or suspicious application. The rule filters out queries from common system processes, known legitimate applications (like Microsoft Defender), and browsers to reduce false positives. The intent is to identify adversaries performing reconnaissance to map out network infrastructure.
Sigma
