Password Policy Enumerated via LDAP Query

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•3

This rule detects attempts to enumerate password policy information, specifically the 'pwdHistoryLength' attribute, from a domain controller via an LDAP query. It looks for TCP traffic on port 389 (LDAP) where the client sends a query containing both '(objectClass=domain)' and 'pwdHistoryLength' in a case-insensitive manner.