Suspicious LDAP Enumeration - BloodHound Activity

Ankit Mehta@Secvyn

•updated Jun 29, 2026•9•0•13

This rule detects high volumes of LDAP queries performed by a single user account from a specific device within a 10-minute window. A significant spike in LDAP query activity is often indicative of automated directory enumeration or reconnaissance, potentially aiming to map the environment, identify target users, or discover services.