ATT&CK T1098 - LDAP Account Modification Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects attempts to modify user accounts via LDAP. It specifically looks for TCP traffic on port 389 (LDAP) containing the hexadecimal representation of '0' (likely part of an LDAP message structure) and the case-insensitive string 'modify'. A threshold of 5 such events within 60 seconds from the same source IP triggers the alert, indicating potential malicious activity related to account manipulation.