ATT&CK T1087 - LDAP User Enumeration Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•4

This rule detects LDAP user enumeration attempts by identifying multiple LDAP queries containing "(objectClass=user)" within a short timeframe (10 queries in 60 seconds) directed to a server on port 389. This behavior is indicative of an attacker trying to discover valid user accounts.