LOLAD - LDAP - Suspicious LDAP Queries for possible recon/exploitation
Detects potential malicious use of LDAP queries associated with Metasploit activity targeting Active Directory. LDAP enumeration can reveal detailed information about users, groups, computers, and other objects within a network that can be exploited by attackers.
Microsoft Sentinel (KQL)
