Suspicious PowerShell LDAP Connection for Credential Access
This rule detects suspicious PowerShell script blocks that contain specific .NET classes often used in LDAP-based credential access attempts. The presence of 'System.DirectoryServices.Protocols.LdapDirectoryIdentifier', 'System.Net.NetworkCredential', and 'System.DirectoryServices.Protocols.LdapConnection' within a PowerShell script block suggests an attempt to interact with an LDAP directory, potentially for password guessing or brute-force attacks against accounts.
Sigma
