Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
2
Categories
2
2
Platforms
2
Products / Services
2
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
Detects in-process LDAP enumeration of Active Directory through the .NET System.DirectoryServices classes, the [adsisearcher] type accelerator and DirectorySearcher, captured from PowerShell ScriptBlock logging in action_evtlog_message. Severity is assigned from the LDAP filter and requested attributes. CRITICAL covers queries after credential-bearing attributes (LAPS, gMSA, sIDHistory, GPP/SYSVOL paths) or DCSync replication rights. HIGH covers known attack-technique targeting: Tier Zero enumeration via adminCount, SPN enumeration for Kerberoasting, delegation attributes, and the UAC bitmask filters used for AS-REP roasting and unconstrained delegation. MEDIUM covers broad estate enumeration across groups, computers, GPOs, and OUs. Command-line context (suspicious parent process, encoded or hidden execution) is surfaced as separate fields for triage rather than folded into the score.
Detects in-process LDAP enumeration of Active Directory through the .NET System.DirectoryServices classes, the [adsisearcher] type accelerator and DirectorySearcher, captured from PowerShell ScriptBlock logging in action_evtlog_message. Severity is assigned from the LDAP filter and requested attributes. CRITICAL covers queries after credential-bearing attributes (LAPS, gMSA, sIDHistory, GPP/SYSVOL paths) or DCSync replication rights. HIGH covers known attack-technique targeting: Tier Zero enumeration via adminCount, SPN enumeration for Kerberoasting, delegation attributes, and the UAC bitmask filters used for AS-REP roasting and unconstrained delegation. MEDIUM covers broad estate enumeration across groups, computers, GPOs, and OUs. Command-line context (suspicious parent process, encoded or hidden execution) is surfaced as separate fields for triage rather than folded into the score.
