New Domain Account Created via LDAP

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects the creation of a new domain account via LDAP. It specifically looks for TCP traffic on port 389 (LDAP) where the flow is to the server and established. The rule then inspects the content for the strings "(objectClass=user)" and "add" (case-insensitive), indicating an LDAP operation to add a new user object.