Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
123 detections
Filters
Last updated
All Time
Detection languages
42
41
26
7
4
Contributors
40
34
15
7
5
Categories
41
34
32
19
19
Platforms
74
31
9
8
4
Products / Services
10,680
9,761
6,694
4,418
3,744
MITRE Techniques
47
29
29
28
26
CVEs
2
2
1
1
1
IDS Classtypes
11
10
5
IDS Protocols
26
Detects anomalous or potentially malicious LDAP queries on Domain Controllers, utilizing Event ID 1644 to monitor query filters. The rule identifies patterns commonly associated with reconnaissance and enumeration activities, including Kerberoasting (SPN enumeration), AS-REP roasting, delegation abuse, Active Directory Certificate Services (AD CS) enumeration, BloodHound collection, and bulk user, group, or computer discovery.
Detects a single host or account generating a high volume of LDAP queries (typical of reconnaissance tools like BloodHound/SharpHound) within a 10-minute time window. The rule specifically looks for more than 500 LDAP queries targeted at a limited number of Domain Controllers.
Detects anomalous LDAP bind requests containing specific byte sequences characteristic of a potential authentication bypass exploit identified as CVE-2026-83059. The rule monitors LDAP traffic on standard ports for malformed bind operations that attempt to subvert authentication controls.
Detects a sequence of activity indicative of beacon-like behavior: initial domain reconnaissance using commands such as 'net', 'systeminfo', or 'nltest', followed by the execution of 'rundll32.exe' without command-line arguments, and subsequent LDAP (port 389) communication to a domain controller, all occurring within a short timeframe.
Detects potentially malicious LDAP queries logged by Windows Server 2025 (Event IDs 3039/3040). The rule monitors for common attacker reconnaissance techniques, including Kerberoasting, AS-REP roasting, delegation abuse, AD CS enumeration, and BloodHound-style data collection patterns.
LDAP Query Extractor | Cortex XDR
Cortex XDR
Extracts LDAP search queries from Microsoft-Windows-LDAP-Client Event ID 30 logs on endpoints. Accepts hostname, username, or IP as input. Shows initiating process with full command line, search filter, base DN, and requested attributes. Good for triaging LDAP enumeration alerts and identifying whether queries come from known AD tools or suspicious recon activity.
Detects the execution of BloodHound related processes combined with a high volume of LDAP queries (Event ID 1644), which is indicative of Active Directory environment reconnaissance.
Detects modification of sensitive Active Directory LDAP attributes (msDS-AllowedToDelegateTo, msDS-AllowedToActOnBehalfOfOtherIdentity, scriptPath, msTSInitialProgram, msDS-KeyCredentialLink) via Windows Security EventCode 5136, and correlates the initiating session back to its originating logon (EventCode 4624) to surface the actor's SID, domain, source IP, and logon host. These attributes are commonly abused for Kerberos delegation abuse (constrained/resource-based constrained delegation), logon-script/Terminal-Services persistence, and Shadow Credentials (msDS-KeyCredentialLink) attacks. Includes anchor fields (initiator SID, domain controller, distinct-attribute count, operation correlation ID) to support precise, low-blast-radius tuning instead of broad exclusions.
Detects in-process LDAP enumeration of Active Directory through the .NET System.DirectoryServices classes, the [adsisearcher] type accelerator and DirectorySearcher, captured from PowerShell ScriptBlock logging in action_evtlog_message. Severity is assigned from the LDAP filter and requested attributes. CRITICAL covers queries after credential-bearing attributes (LAPS, gMSA, sIDHistory, GPP/SYSVOL paths) or DCSync replication rights. HIGH covers known attack-technique targeting: Tier Zero enumeration via adminCount, SPN enumeration for Kerberoasting, delegation attributes, and the UAC bitmask filters used for AS-REP roasting and unconstrained delegation. MEDIUM covers broad estate enumeration across groups, computers, GPOs, and OUs. Command-line context (suspicious parent process, encoded or hidden execution) is surfaced as separate fields for triage rather than folded into the score.
Detects in-process LDAP enumeration of Active Directory through the .NET System.DirectoryServices classes, the [adsisearcher] type accelerator and DirectorySearcher, captured from PowerShell ScriptBlock logging in action_evtlog_message. Severity is assigned from the LDAP filter and requested attributes. CRITICAL covers queries after credential-bearing attributes (LAPS, gMSA, sIDHistory, GPP/SYSVOL paths) or DCSync replication rights. HIGH covers known attack-technique targeting: Tier Zero enumeration via adminCount, SPN enumeration for Kerberoasting, delegation attributes, and the UAC bitmask filters used for AS-REP roasting and unconstrained delegation. MEDIUM covers broad estate enumeration across groups, computers, GPOs, and OUs. Command-line context (suspicious parent process, encoded or hidden execution) is surfaced as separate fields for triage rather than folded into the score.
This rule detects potential brute force authentication attempts via LDAP occurring shortly after a specific DLL (ending in 'ode.dll') is loaded on a system. This behavior may indicate an adversary is using a malicious or secondary module to facilitate credential brute forcing or unauthorized authentication attempts.
Detects high-volume or multi-account failed LDAP simple-bind authentication attempts against the Active Directory Global Catalog port (3268). This behavior is consistent with automated password spraying or brute-force tools, such as the Cavern Manticore LdapBrute module, which attempt to validate credentials across multiple accounts.
This rule detects high volumes of LDAP queries performed by a single user account from a specific device within a 10-minute window. A significant spike in LDAP query activity is often indicative of automated directory enumeration or reconnaissance, potentially aiming to map the environment, identify target users, or discover services.
This rule detects high volumes of LDAP queries performed by a single user account from a specific device within a 10-minute window. A significant spike in LDAP query activity is often indicative of automated directory enumeration or reconnaissance, potentially aiming to map the environment, identify target users, or discover services.
Detects high-volume LDAP queries targeting sensitive Active Directory attributes such as userAccountControl, adminCount, and objectCategory. This behavior is indicative of automated directory enumeration tools like SharpHound or BloodHound performing reconnaissance to identify high-value targets or privileged accounts.
This rule detects potential automated reconnaissance or credential harvesting by monitoring for high volumes of LDAP queries targeting sensitive Active Directory attributes. It correlates both LDAP query events and Windows Security Event ID 4662 to identify bulk access to attributes like 'samAccountName', 'userPassword', and 'memberOf'.
Detects high-volume LDAP queries targeting sensitive Active Directory attributes such as userAccountControl, adminCount, and objectCategory. This behavior is indicative of automated directory enumeration tools like SharpHound or BloodHound performing reconnaissance to identify high-value targets or privileged accounts.
This rule detects potential automated reconnaissance or credential harvesting by monitoring for high volumes of LDAP queries targeting sensitive Active Directory attributes. It correlates both LDAP query events and Windows Security Event ID 4662 to identify bulk access to attributes like 'samAccountName', 'userPassword', and 'memberOf'.
Detects high-volume LDAP queries or specific expensive LDAP search events (Event ID 1644) on Domain Controllers, which are often indicative of reconnaissance activities such as domain environment mapping or user/group enumeration.
This rule detects high-volume connection requests to LDAP services (default ports 389, 636, 3268, 3269). A high number of connections from a single source to a destination within a short time window may indicate automated reconnaissance, LDAP enumeration, or brute-force attempts against domain services.
Detects high-volume LDAP queries or specific expensive LDAP search events (Event ID 1644) on Domain Controllers, which are often indicative of reconnaissance activities such as domain environment mapping or user/group enumeration.
Page 1 of 6