Authentication Configuration Modified via LDAP

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects attempts to modify authentication configuration via LDAP by looking for the string "msDS-SupportedEncryptionTypes" in TCP traffic destined for port 389 (LDAP). This string is associated with changes to supported encryption types in Active Directory, which could be an indicator of persistence or privilege escalation.