Detection rules › Kusto
Suspicious LDAP Queries from Information Gathering Tools
This rule detects usage of LDAP information gathering tools such as BloodHound, SharpHound or potential custom tools mimicking the behavior of the legitimate tool ADExplorer from Sysinternals. The rule detects tool-specific LDAP queries and also contains a custom "Signature" field, providing information about the exact tool that most probably created the detected LDAP query.
Known false positives
- None expected.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Discovery |
References
Telemetry coverage
| Platform | Record / event type |
|---|---|
| Microsoft Defender for Endpoint | IdentityQueryEvents action LDAP query: LDAP query |
Rule body
let timeframe = 2*1h;
let SharphoundCheck = IdentityQueryEvents
| where ActionType == "LDAP query"
| where QueryType contains "AllSecurityPrincipals" and QueryType contains "AllDomains" // Sharphound-specific behavior.
| where ingestion_time() >= ago(timeframe)
| extend Signature = "Sharphound";
let BloodhoundCheck = IdentityQueryEvents
| where ActionType == "LDAP query"
| where Query contains "sAMAccountType=805306369" and Query contains "userAccountControl&2" // Bloodhound.py-specific behavior.
| where ingestion_time() >= ago(timeframe)
| extend Signature = "Bloodhound.py";
let ADExplorerMimickCheck = IdentityQueryEvents
| where ActionType == "LDAP query"
| where Query contains "GUID=*" // ADExplorer-specific behavior.
| where ingestion_time() >= ago(timeframe)
| extend Signature = "ADExplorer mimicker";
SharphoundCheck | union ADExplorerMimickCheck, BloodhoundCheck
| summarize arg_min(Timestamp,*),Signature=make_set(Signature) by DeviceName, Query, ReportId
| sort by Timestamp desc
// Begin environment-specific filter.
// End environment-specific filter.
Stages and Predicates
Parameters
let timeframe = 2*1h;
let SharphoundCheck, let BloodhoundCheck and let ADExplorerMimickCheck are inlined into the numbered stages below.
Stage 1: source
let SharphoundCheck
Stage 2: source
let BloodhoundCheck
Stage 3: source
let ADExplorerMimickCheck
Stage 4: source
IdentityQueryEvents
Stage 5: where
where ActionType =~ "LDAP query"
Stage 6: where
where QueryType contains "AllDomains" and QueryType contains "AllSecurityPrincipals"
Stage 7: where
where ...
Stage 8: extend
extend Signature
Stage 9: union
union of 2 branches
Stage 10: source
IdentityQueryEvents
Stage 11: where
where ActionType =~ "LDAP query"
Stage 12: where
where Query contains "GUID=*"
Stage 13: where
where ...
Stage 14: extend
extend Signature
Stage 15: source
IdentityQueryEvents
Stage 16: where
where ActionType =~ "LDAP query"
Stage 17: where
where Query contains "sAMAccountType=805306369" and Query contains "userAccountControl&2"
Stage 18: where
where ...
Stage 19: extend
extend Signature
Stage 20: summarize
summarize Signature by DeviceName, Query, ReportId
Stage 21: sort
sort by Timestamp
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
ActionType | eq |
| field:"ActionType" kind:eq value:"LDAP query" |
Query | contains |
| field:"Query" kind:contains |
QueryType | contains |
| field:"QueryType" kind:contains |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
DeviceName | summarize |
Query | summarize |
ReportId | summarize |
Signature | summarize |