Domain Trust Relationship Enumeration via LDAP

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects attempts to enumerate domain trust relationships using LDAP queries. Specifically, it looks for TCP traffic on port 389 (LDAP) containing the string "(objectClass=trustedDomain)" in the server-bound flow. This string is commonly used in LDAP queries to discover trusted domains within an Active Directory environment, which can be a reconnaissance step for attackers.