BloodHound/SharpHound LDAP Enumeration via High-Volume Identity Queries
Detects high-volume LDAP queries targeting sensitive Active Directory attributes such as userAccountControl, adminCount, and objectCategory. This behavior is indicative of automated directory enumeration tools like SharpHound or BloodHound performing reconnaissance to identify high-value targets or privileged accounts.
Microsoft Sentinel (KQL)
