Defender-IdentityQueryEvents

ActionType	Title	Sample	Rule
any	Identity query activity	N	N
DNS query	DNS query	N	N
LDAP query	LDAP query	N	Y
LdapQuery	Ldap query	N	N
SAMR query	SAMR query	N	N

any: Identity query activity

Suspicious LDAP Queries from Information Gathering Tools source: This rule detects usage of LDAP information gathering tools such as BloodHound, SharpHound or potential custom tools mimicking the behavior of the legitimate tool ADExplorer from Sysinternals. The rule detects tool-specific LDAP queries and also contains a custom "Signature" field, providing information about the exact tool that most probably created the detected LDAP query.T1087, T1087.002, T1482