LDAP Domain Trust Enumeration

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•4

This Suricata rule detects attempts to enumerate domain trusts via LDAP. It specifically looks for TCP traffic on port 389 (LDAP) where the content of the packet contains the string "(objectClass=trustedDomain)" in a case-insensitive manner. This activity is indicative of an attacker trying to discover relationships between domains, which is a common step in reconnaissance and lateral movement within an Active Directory environment.