Defender-IdentityQueryEvents

ActionType	Title	Sample	Rule
DNS query	DNS query	N	N
LDAP query	LDAP query	N	Y
LdapQuery	Ldap query	N	N
SAMR query	SAMR query	N	N

DNS query

Table: IdentityQueryEvents

LDAP query

Table: IdentityQueryEvents

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

Name	Rules	Vendors
`ActionType`	1 detection rule	Kusto
`Query`	1 detection rule	Kusto
`QueryType`	1 detection rule	Kusto

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Kusto #

Suspicious LDAP Queries from Information Gathering Tools source: This rule detects usage of LDAP information gathering tools such as BloodHound, SharpHound or potential custom tools mimicking the behavior of the legitimate tool ADExplorer from Sysinternals. The rule detects tool-specific LDAP queries and also contains a custom "Signature" field, providing information about the exact tool that most probably created the detected LDAP query.T1087, T1087.002, T1482

LdapQuery: Ldap query

Table: IdentityQueryEvents

SAMR query

Table: IdentityQueryEvents

any: Identity query activity

Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.

Table: IdentityQueryEvents