Domain Trust Modification via LDAP Write
This rule detects attempts to modify domain trust relationships via LDAP write operations. It specifically looks for TCP traffic on port 389 (LDAP) to the home network, containing the case-insensitive strings "trustType" and "trustDirection". This activity could indicate an attacker attempting to establish or alter trust relationships between domains for privilege escalation or lateral movement.
Suricata
