Microsoft-Windows-LDAP-Client
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1 | task_0 | Debug | N | N |
| 2 | task_02 | Debug | N | N |
| 3 | task_03 | Debug | N | N |
| 4 | task_04 | Debug | N | N |
| 5 | task_05 | Debug | N | N |
| 6 | task_06 | Debug | N | N |
| 7 | task_07 | Debug | N | N |
| 8 | task_08 | Debug | N | N |
| 9 | task_09 | Debug | N | N |
| 10 | task_010 | Debug | N | N |
| 11 | task_011 | Debug | N | N |
| 12 | task_012 | Debug | N | N |
| 13 | task_013 | Debug | N | N |
| 14 | task_014 | Debug | N | N |
| 15 | task_015 | Debug | N | N |
| 16 | task_016 | Debug | N | N |
| 17 | task_017 | Debug | N | N |
| 18 | task_018 | Debug | N | N |
| 19 | task_019 | Debug | N | N |
| 20 | task_020 | Debug | N | N |
| 21 | task_021 | Debug | N | N |
| 22 | task_022 | Debug | N | N |
| 23 | task_023 | Debug | N | N |
| 24 | task_024 | Debug | N | N |
| 25 | task_025 | Debug | N | N |
| 26 | task_026 | Debug | N | N |
| 27 | task_027 | Debug | N | N |
| 28 | task_028 | Debug | N | N |
| 29 | task_029 | Debug | N | N |
| 30 | LDAP search request | Debug | Y | Y |
| 31 | task_031 | Debug | N | N |
Event ID 30: LDAP search request
#Description
Emitted by wldap32.dll when an LDAP search is submitted to the server. Captures the search filter, base DN, scope, and requested attributes as supplied by the client process. Fires for every ldap_search call including rootDSE probes and paged searches. Verified by live ETW capture on Win11 26200 (2026-06-05).
Fields #
| Name | Description | Rules |
|---|---|---|
ScopeOfSearch UInt32 | LDAP search scope: 0 = base (root object only), 1 = one-level, 2 = subtree | |
SearchFilter UnicodeString | LDAP search filter string (RFC 4515 syntax), e.g. (objectClass=user) | 49 detection rules |
DistinguishedName UnicodeString | Base distinguished name for the search; empty string indicates rootDSE | 3 detection rules |
AttributeList UnicodeString | Requested attribute names, semicolon-separated; empty requests all non-operational attributes | |
ProcessId HexInt32 | Hex PID of the process initiating the LDAP search |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-LDAP-Client",
"guid": "{099614a5-5dd7-4788-8bc9-e29f43db28fc}",
"event_source_name": "",
"event_id": "30",
"version": "0",
"level": "0",
"task": "0",
"opcode": "0",
"keywords": -9223372036854775807,
"time_created": "2026-06-05T07:31:06.778512400+00:00",
"event_record_id": 16,
"correlation": {
"ActivityID": "{ae3adfdf-f2b5-0000-41b2-43aeb5f2dc01}"
},
"execution": {
"process_id": "4580",
"thread_id": "6584"
},
"channel": "Microsoft-Windows-LDAP-Client/Debug",
"computer": "DESKTOP-FF3N5XK.ludus.domain",
"security": {
"user_id": ""
}
},
"event_data": {
"ScopeOfSearch": "2",
"SearchFilter": "(objectClass=user)",
"DistinguishedName": "DC=ludus,DC=domain",
"AttributeList": "",
"ProcessId": "0x11E4"
},
"message": ""
}
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma # view in coverage
Provenance
ETW provider GUID 099614a5-5dd7-4788-8bc9-e29f43db28fc
Defined in wldap32.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB