Active Directory Trust Discovery via LDAP

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•5

This rule detects network connections to port 389 (LDAP) that contain specific keywords related to Active Directory trust relationships. This could indicate an adversary attempting to discover trust details within an Active Directory environment.