Bulk Account Deletion via LDAP for Access Removal

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•1

This rule detects bulk account deletion attempts via LDAP. It triggers when multiple LDAP requests (at least 5 within 30 seconds from the same source IP) are observed on port 389, containing both 'userAccountControl' and 'delete' keywords, indicating an attempt to modify user account control attributes to disable or delete accounts.