Password Spraying Enumeration via LDAP

[rule]
description = """
Identifies a list of common LDAP search queries used to gather candidate accounts before launching password spraying
attacks.
"""
id = "375b5571-4cc4-427e-a39e-77b7f18f3d7e"
license = "Elastic License v2"
name = "Password Spraying Enumeration via LDAP"
os_list = ["windows"]
reference = ["https://attack.mitre.org/techniques/T1201/"]
version = "1.0.3"

query = '''
api where process.Ext.api.name == "ldap_search" and user.id != "S-1-5-18" and
 not process.executable :
             ("?:\\Program Files\\Azure Advanced Threat Protection Sensor\\*\\Microsoft.Tri.Sensor.exe",
              "?:\\Windows\\ADFS\\Microsoft.IdentityServer.ServiceHost.exe",
              "?:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe",
              "?:\\Program Files (x86)\\Trend Micro\\Security Agent\\PccNTMon.exe",
              "?:\\Program Files\\Microsoft SQL Server\\MSSQL??.MSSQLSERVER\\MSSQL\\Binn\\sqlservr.exe") and
 process.Ext.api.parameters.search_filter : (
  // Enabled accounts
  "(&(objectCategory=person)(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))",
  "(&(objectCategory=Computer)(!userAccountControl:1.2.840.113556.1.4.803:=2))",

  // Password never set / reset conditions
  "(&(objectCategory=person)(objectClass=user)*(pwdLastSet=0))",
  "(&(objectCategory=person)(objectClass=user)*(pwdLastSet>=129473172000000000))",

  // Weak password policy accounts
  "(&(objectCategory=person)(objectClass=user)*(userAccountControl:1.2.840.113556.1.4.803:=65536))", // PASSWD_NEVER_EXPIRES
  "(&(objectCategory=person)(objectClass=user)*(userAccountControl:1.2.840.113556.1.4.803:=32))",    // PASSWD_NOTREQD

  // Spray candidate filters
  "(&(samAccountType=805306368)(|(homeDirectory=?)(scriptPath=*)(profilePath=?)))",
  "(&(objectCategory=person)(objectClass=user)(directReports=?)(!(manager=?)))"
 )
'''

min_endpoint_version = "9.1.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1087"
name = "Account Discovery"
reference = "https://attack.mitre.org/techniques/T1087/"
[[threat.technique.subtechnique]]
id = "T1087.002"
name = "Domain Account"
reference = "https://attack.mitre.org/techniques/T1087/002/"


[[threat.technique]]
id = "T1201"
name = "Password Policy Discovery"
reference = "https://attack.mitre.org/techniques/T1201/"


[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[internal]
min_endpoint_version = "9.1.0"