Distributed File System Shares Enumeration via LDAP

[rule]
description = """
Identifies attempts to enumerate Distributed File System Shares using LDAP queries. Adversaries often query DFS links to
learn about every central file share across the org without scanning the network. DFS shares might contain sensitive
data (backups, GPO scripts, credentials, installer packages) or access controlled areas if permissions are
misconfigured.
"""
id = "559c64c5-47f9-44b1-9261-4295eff8491f"
license = "Elastic License v2"
name = "Distributed File System Shares Enumeration via LDAP"
os_list = ["windows"]
reference = ["https://attack.mitre.org/techniques/T1087/002/"]
version = "1.0.3"

query = '''
api where process.Ext.api.name == "ldap_search" and
 process.Ext.api.parameters.search_filter : ("(&(objectClass=msDFS-Linkv2))", "(objectClass=msDFS-Linkv2)", "objectClass=msDFS-Linkv2") and
 process.Ext.api.parameters.attribute_list : "msdfs-linkpathv2" and process.Ext.api.parameters.attribute_list : "msDFS-TargetListv2"
'''

min_endpoint_version = "9.1.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1135"
name = "Network Share Discovery"
reference = "https://attack.mitre.org/techniques/T1135/"


[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[internal]
min_endpoint_version = "9.1.0"