• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    PasswordSearch

    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Azure Sentinel@AzureSentinel
    •updated Jun 17, 2025•5•0•43

    Detect Active Directory LDAP queries that search for users with comment or description that contains the string "pass" that might suggest for the user password This LDAP query cover MetaSploit - enum_ad_user_comments tool

    Microsoft Sentinel (KQL)

    Tags

    TA0006 - Credential AccessT1212 - Exploitation for Credential AccessT1087 - Account DiscoveryT1087.002 - Domain AccountTA0007 - DiscoveryS0174 - ResponderS0154 - Cobalt StrikeS0039 - MetasploitCredential AccessCommand ExecutionWindowsActive Directory LdapMicrosoft Iiskql

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?