Sensitive Attributes Discovery via LDAP

[rule]
description = """
Attackers often query LDAP for sensitive attributes that may contain credentials, password-like values, or LAPS-managed
local admin passwords.
"""
id = "b64874f2-a50c-4fb0-837e-cc1925067587"
license = "Elastic License v2"
name = "Sensitive Attributes Discovery via LDAP"
os_list = ["windows"]
reference = [
    "https://bloodhound.specterops.io/resources/edges/read-laps-password",
    "https://github.com/netwrix/LAPS-Permissions-Collection/blob/master/LAPS_Permissions_Collection.ps1",
]
version = "1.0.3"

query = '''
api where process.Ext.api.name == "ldap_search" and user.id != "S-1-5-18" and
 not process.executable :
             ("?:\\Program Files\\Azure Advanced Threat Protection Sensor\\*\\Microsoft.Tri.Sensor.exe",
              "?:\\Windows\\ADFS\\Microsoft.IdentityServer.ServiceHost.exe") and
 process.Ext.api.parameters.search_filter : (
  // LAPS attributes
  "*(name=ms-Mcs-AdmPwd)*",
  "(&(objectCategory=Computer)(ms-MCS-AdmPwd=?))",
  "*(name=ms-Mcs-AdmPwdExpirationTime)*",
  "*(name=msLAPS-Password)*",

  // Password related attributes
  "*(name=dBCSPwd)",
  "*(name=lmPwdHistory)*",
  "*(name=ntPwdHistory)*",
  "*(name=supplementalCredentials)*",

  // Defender token and secret attributes
  "*defender-tokenData=*",
  "(name=*secret*)",
  "(name=*trust*)",

  // passwords in description or comments
  "(&(&(objectCategory=person)(objectClass=user))(|(description=?pass?)(comment=?pass?)))"
 )
'''

min_endpoint_version = "9.1.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1087"
name = "Account Discovery"
reference = "https://attack.mitre.org/techniques/T1087/"
[[threat.technique.subtechnique]]
id = "T1087.002"
name = "Domain Account"
reference = "https://attack.mitre.org/techniques/T1087/002/"


[[threat.technique]]
id = "T1482"
name = "Domain Trust Discovery"
reference = "https://attack.mitre.org/techniques/T1482/"


[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[internal]
min_endpoint_version = "9.1.0"