Unusual LDAP Client Process

[rule]
description = """
Identifies an unusual Windows native process performing LDAP activity. This may indicate an attempt to perform domain
discovery using the LDAP protocol.
"""
id = "968e989d-de58-48db-9a06-38a170090def"
license = "Elastic License v2"
name = "Unusual LDAP Client Process"
os_list = ["windows"]
version = "1.0.23"

query = '''
sequence by process.entity_id with maxspan=1m
 [process where event.action == "start" and
  process.executable : ("?:\\Windows\\system32\\*", "?:\\Windows\\SysWOW64\\*") and
  process.parent.name != null and
  process.code_signature.subject_name : "Microsoft *" and 
  not process.name : ("powershell.exe", "powershell_ise.exe", "pwsh.exe") and
  not process.executable : 
            ("?:\\Windows\\AdminArsenal\\PDQInventory-Scanner\\service-1\\exec\\PDQInventoryScanner.exe", 
             "?:\\Windows\\System32\\wbem\\WmiPrvSE.exe", 
             "?:\\Windows\\System32\\inetsrv\\w3wp.exe", 
             "?:\\Windows\\SysWOW64\\inetsrv\\w3wp.exe", 
             "?:\\Windows\\System32\\wsmprovhost.exe", 
             "?:\\Windows\\System32\\Essentials\\SharedServiceHost.exe",
             "?:\\Windows\\System32\\Essentials\\RunTask.exe",
             "?:\\Windows\\System32\\Essentials\\ProviderRegistryService.exe",
             "?:\\Windows\\System32\\mmc.exe", 
             "?:\\Windows\\SysWOW64\\mmc.exe", 
             "?:\\Windows\\System32\\ServerManager.exe", 
             "?:\\Windows\\System32\\dsac.exe", 
             "?:\\Windows\\System32\\Vmw.exe", 
             "?:\\Windows\\SysWOW64\\msiexec.exe", 
             "?:\\Windows\\System32\\msiexec.exe", 
             "?:\\Windows\\System32\\ClusterUpdateUI.exe",
             "?:\\Windows\\System32\\Essentials\\Dashboard.exe",
             "?:\\Windows\\System32\\gpresult.exe",
             "?:\\Windows\\System32\\RAMgmtUI.exe",
             "?:\\Windows\\System32\\LogonUI.exe",
             "?:\\Windows\\System32\\consent.exe",
             "?:\\Windows\\System32\\conhost.exe") and
  not (process.executable :
            ("?:\\Windows\\System32\\dllhost.exe",
             "?:\\Windows\\System32\\taskhost*.exe",
             "?:\\Windows\\SysWOW64\\dllhost.exe",
             "?:\\Windows\\SysWOW64\\taskhost*.exe") and
       process.parent.executable : "?:\\Windows\\System32\\svchost.exe") and
  not (process.name : "dllhost.exe" and process.args : "/Processid:{7F9BBC82-BA5F-4448-8622-EF76B8D007E6}") and
  not (process.name : "rundll32.exe" and
       process.command_line : "*zzzzInvokeManagedCustomActionOutOfProc*" and process.parent.name : "msiexec.exe") and
  not (process.name : ("cscript.exe", "wscript.exe") and
       process.parent.executable : "?:\\Program Files\\Microsoft Monitoring Agent\\Agent\\MonitoringHost.exe") and
  not (process.code_signature.subject_name : ("PDQ.com Corporation", "ci solution GmbH") and process.code_signature.trusted == true) and
  not (process.executable : "?:\\Windows\\system32\\svchost.exe" and process.args : "gpsvc" and process.parent.name : "services.exe")
  ]
 [library where dll.name : "System.DirectoryServices*.dll"]
 [network where destination.port == 389 and source.port >= 49152 and
  network.direction == "egress" and network.transport == "tcp" and
  not destination.address : ("127.*", "::1")]
'''

min_endpoint_version = "7.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1558"
name = "Steal or Forge Kerberos Tickets"
reference = "https://attack.mitre.org/techniques/T1558/"


[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "7.16.0"