Threat Hunt: RPC-to-LDAP Abuse for DoS/DDoS Attacks - Win-DOS Research based
This hunting query detects potential abuse of the MS-RPC protocol for DoS/DDoS attacks by monitoring outbound LDAP-related DNS queries originating from Domain Controllers. It is inspired by the SafeBreach “Win-DOS Epidemic” research, which revealed a technique where attackers abuse RPC calls to trigger massive LDAP query floods. The query flags high-volume _ldap queries to external (non-private) IPs, with extra scrutiny on processes like lsass.exe and svchost.exe that, if abused, may indicate system-level compromise or protocol exploitation. The detection is filtered to DC naming conventions (DC*) to reduce false positives and maintain high fidelity. Stage 1 logic integrated from SlimKQL.
Microsoft Sentinel (KQL)
