Domain Group Membership Enumerated via LDAP
This rule detects attempts to enumerate domain group membership via LDAP queries. It specifically looks for TCP traffic to port 389 (LDAP) containing the string "(objectClass=group)" in a case-insensitive manner. A threshold is applied to trigger an alert if 10 such queries are observed from the same source within a 30-second window, indicating a potential network scan or reconnaissance activity.
Suricata
