Domain Computers Enumeration via LDAP Search

[rule]
description = "Identifies a list of suspicious LDAP queries often used by reconnaissance tools to enumerate domain computers."
id = "0380d8b9-e643-40b9-a763-67ab52021bb4"
license = "Elastic License v2"
name = "Domain Computers Enumeration via LDAP Search"
os_list = ["windows"]
reference = ["https://attack.mitre.org/techniques/T1087/002/"]
version = "1.0.4"

query = '''
api where process.Ext.api.name == "ldap_search" and user.id != "S-1-5-18" and
 not process.executable :
             ("?:\\Program Files\\Azure Advanced Threat Protection Sensor\\*\\Microsoft.Tri.Sensor.exe",
              "?:\\Windows\\ADFS\\Microsoft.IdentityServer.ServiceHost.exe") and
 process.Ext.api.parameters.search_filter : (
  "(&(objectCategory=computer)(operatingSystem=?server?))",
  "(&(sAMAccountType=805306369)(dnshostname=?))",
  "(&(objectCategory=computer)(lastLogon>=*)(operatingSystem=*windows*))",
  "(&(objectCategory=computer)(lastLogonTimestamp<=133000000000000000))",
  "(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=524288))",
  "(&(objectCategory=Computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))",
  "*(&(objectclass=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))*",
  "(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192)",
  "(&(objectclass=computer)(userAccountControl&8192))",
  "(&(&(&(&(samAccountType=805306369)(!(primaryGroupId=516)))(objectCategory=computer)(operatingSystem=Windows Server?))))",
  "(&(objectCategory=computer)(operatingSystem=?server?)(!(userAccountControl:1.2.840.113556.1.4.803:=8192)))"
 ) and 
 not (process.code_signature.subject_name in ("Specops Software Inc.", "Azul Systems, Inc.") and process.code_signature.trusted == true)
'''

min_endpoint_version = "9.1.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1082"
name = "System Information Discovery"
reference = "https://attack.mitre.org/techniques/T1082/"

[[threat.technique]]
id = "T1087"
name = "Account Discovery"
reference = "https://attack.mitre.org/techniques/T1087/"
[[threat.technique.subtechnique]]
id = "T1087.002"
name = "Domain Account"
reference = "https://attack.mitre.org/techniques/T1087/002/"



[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[internal]
min_endpoint_version = "9.1.0"