ATT&CK T1110.003 - LDAP Password Spray Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects a password spraying attack targeting LDAP services. It triggers an alert if there are 50 or more TCP connections to port 389 (LDAP) on the home network within a 60-second window, originating from the same destination IP address. This pattern is indicative of an attacker attempting to authenticate with a small set of passwords against many accounts.