Domain Trust and Schema Enumeration via LDAP

[rule]
description = """
Identifies a list of LDAP search queries to enumerate domain policies and trusts. Adversaries attempt to enumerate
information on the Active Directory structure by using various LDAP-based discovery queries to identify targets for
attack.
"""
id = "9c928393-2aeb-4143-8ed6-c9704c094f76"
license = "Elastic License v2"
name = "Domain Trust and Schema Enumeration via LDAP"
os_list = ["windows"]
reference = ["https://attack.mitre.org/techniques/T1482/"]
version = "1.0.3"

query = '''
api where process.Ext.api.name == "ldap_search" and not user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
 not process.executable :
             ("?:\\Program Files\\Azure Advanced Threat Protection Sensor\\*\\Microsoft.Tri.Sensor.exe",
              "?:\\Windows\\System32\\lsass.exe",
              "?:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe",
              "?:\\Windows\\ADFS\\Microsoft.IdentityServer.ServiceHost.exe", 
              "?:\\Program Files\\Fortinet\\FortiAuthenticator Agent\\FAC_Agent.Configuration.exe") and
 (
  (process.Ext.api.parameters.search_filter : "(objectclass=trusteddomain)" and process.Ext.api.parameters.distinguished_name like "dc=*") or

  (process.Ext.api.parameters.search_filter : "(schemaIDGUID=?)" and process.Ext.api.parameters.distinguished_name like "cn=schema,cn=configuration,dc=*")
  ) and 
  not (process.code_signature.subject_name == "Fortinet, Inc." and process.code_signature.trusted == true)
'''

min_endpoint_version = "9.1.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1069"
name = "Permission Groups Discovery"
reference = "https://attack.mitre.org/techniques/T1069/"
[[threat.technique.subtechnique]]
id = "T1069.002"
name = "Domain Groups"
reference = "https://attack.mitre.org/techniques/T1069/002/"


[[threat.technique]]
id = "T1087"
name = "Account Discovery"
reference = "https://attack.mitre.org/techniques/T1087/"
[[threat.technique.subtechnique]]
id = "T1087.002"
name = "Domain Account"
reference = "https://attack.mitre.org/techniques/T1087/002/"


[[threat.technique]]
id = "T1482"
name = "Domain Trust Discovery"
reference = "https://attack.mitre.org/techniques/T1482/"


[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[internal]
min_endpoint_version = "9.1.0"