Suspicious LDAP Query Patterns via Event IDs 3039/3040

Lacey Cochrane@NullVectorX

•updated Sep 25, 2026•0•0•0

Detects potentially malicious LDAP queries logged by Windows Server 2025 (Event IDs 3039/3040). The rule monitors for common attacker reconnaissance techniques, including Kerberoasting, AS-REP roasting, delegation abuse, AD CS enumeration, and BloodHound-style data collection patterns.