Active Directory Data Collection via LDAP

[rule]
description = """
In an Active Directory LDAP query, (objectGUID=*) is a search filter that evaluates to TRUE for every object in the
directory, meaning it will return all objects. This may indicate an attempt to dump AD database using tools such as
ADExplorer for offline analysis or exfiltration.
"""
id = "e79d5328-16fc-45ea-8179-ea2746042af6"
license = "Elastic License v2"
name = "Active Directory Data Collection via LDAP"
os_list = ["windows"]
reference = ["https://learn.microsoft.com/en-us/windows/win32/adschema/a-objectguid"]
version = "1.0.3"

query = '''
api where process.Ext.api.name == "ldap_search" and process.Ext.api.parameters.search_filter : ("(objectGUID=?)", "objectGUID=?")
'''

min_endpoint_version = "9.1.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1069"
name = "Permission Groups Discovery"
reference = "https://attack.mitre.org/techniques/T1069/"
[[threat.technique.subtechnique]]
id = "T1069.002"
name = "Domain Groups"
reference = "https://attack.mitre.org/techniques/T1069/002/"


[[threat.technique]]
id = "T1087"
name = "Account Discovery"
reference = "https://attack.mitre.org/techniques/T1087/"
[[threat.technique.subtechnique]]
id = "T1087.002"
name = "Domain Account"
reference = "https://attack.mitre.org/techniques/T1087/002/"


[[threat.technique]]
id = "T1482"
name = "Domain Trust Discovery"
reference = "https://attack.mitre.org/techniques/T1482/"

[[threat.technique]]
id = "T1482"
name = "Domain Trust Discovery"
reference = "https://attack.mitre.org/techniques/T1482/"

[[threat.technique]]
id = "T1615"
name = "Group Policy Discovery"
reference = "https://attack.mitre.org/techniques/T1615/"


[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[internal]
min_endpoint_version = "9.1.0"