PasswordSearch
Detect Active Directory LDAP queries that search for users with comment or description that contains the string "pass" that might suggest for the user password This LDAP query cover MetaSploit - enum_ad_user_comments tool
Microsoft Sentinel (KQL)
