LDAP Query for Active User Sessions
This rule detects potential network scanning activity targeting LDAP services (port 389) for user session information. It specifically looks for LDAP queries containing "(objectClass=user)" and "lastLogon" within the established TCP flow to the server. A threshold of 5 such queries from the same source within 30 seconds triggers the alert, indicating a possible attempt to enumerate active user sessions.
Suricata
