Local or Domain Group Membership Modified

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects attempts to modify local or domain group memberships by monitoring TCP traffic on port 389 (LDAP). It specifically looks for the keywords "member" and "add" within the traffic, indicating an attempt to add a member to a group. A threshold of 5 occurrences within 60 seconds from the same source IP is set to reduce false positives.