User Account Masquerading as Service Account

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects TCP traffic to port 389 (LDAP) where the content of the packet contains both "sAMAccountName" and "admin" (case-insensitive). This combination suggests an attempt to query or manipulate an LDAP directory for an account named 'admin' using the sAMAccountName attribute, potentially indicating user account masquerading as a service account or reconnaissance activity.