LDAP recon/brute-force via ode.dll module correlated with bind bursts
This rule detects potential brute force authentication attempts via LDAP occurring shortly after a specific DLL (ending in 'ode.dll') is loaded on a system. This behavior may indicate an adversary is using a malicious or secondary module to facilitate credential brute forcing or unauthorized authentication attempts.
Microsoft Sentinel (KQL)
