Domain Password Policy Enumeration via LDAP

[rule]
description = """
Detects LDAP search queries commonly used to enumerate domain password policies. Adversaries may perform this activity
to identify potential weaknesses that could be exploited for privilege escalation or lateral movement.
"""
id = "bbf68a5c-9346-40f4-8a9b-da3d9136f39f"
license = "Elastic License v2"
name = "Domain Password Policy Enumeration via LDAP"
os_list = ["windows"]
reference = ["https://attack.mitre.org/techniques/T1201/"]
version = "1.0.3"

query = '''
api where process.Ext.api.name == "ldap_search" and user.id != "S-1-5-18" and
not process.executable :
             ("?:\\Program Files\\Azure Advanced Threat Protection Sensor\\*\\Microsoft.Tri.Sensor.exe",
              "?:\\Windows\\ADFS\\Microsoft.IdentityServer.ServiceHost.exe",
              "?:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe") and
(
  (process.Ext.api.parameters.search_filter : "*msDS-PasswordSettings*" and
   process.Ext.api.parameters.attribute_list == "msDS-MinimumPasswordLength" and process.Ext.api.parameters.attribute_list == "msDS-LockoutThreshold") or

  process.Ext.api.parameters.search_filter : "*(pwdlastset>=*(operatingSystem=*windows*))"
)
'''

min_endpoint_version = "9.1.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1087"
name = "Account Discovery"
reference = "https://attack.mitre.org/techniques/T1087/"
[[threat.technique.subtechnique]]
id = "T1087.002"
name = "Domain Account"
reference = "https://attack.mitre.org/techniques/T1087/002/"


[[threat.technique]]
id = "T1201"
name = "Password Policy Discovery"
reference = "https://attack.mitre.org/techniques/T1201/"


[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[internal]
min_endpoint_version = "9.1.0"