ATT&CK T1087 - Global Catalog LDAP Enumeration

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects potential Global Catalog LDAP enumeration attempts. It triggers when a source IP makes 10 or more TCP connections to destination port 3268 (the default port for Global Catalog LDAP) within a 60-second window. This behavior can indicate an attacker attempting to discover information about users, groups, and computers within an Active Directory environment.