New Domain Trust Created via LDAP

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects the creation of a new domain trust via LDAP by looking for specific content in TCP traffic on port 389 (LDAP). It specifically targets HTTP POST requests containing "(objectClass=trustedDomain)" in the payload, indicating an attempt to establish a new trust relationship between domains.