MultipleLdaps

Description

Detect multiple Active Directory LDAP queries made in bin time Replace 10 on line 1 with your desired thershold Replace 1m on line 2 with your desired bin time

Query · kql

let Thershold = 10;
let BinTime = 1m;
IdentityQueryEvents
| where ActionType == "LDAP query"
| parse Query with * "Search Scope: " SearchScope ", Base Object:" BaseObject ", Search Filter: " SearchFilter
| summarize NumberOfLdapQueries = count(), NumberOfDistinctLdapQueries = dcount(SearchFilter) by DeviceName, bin(Timestamp, BinTime)
| where NumberOfDistinctLdapQueries > Thershold
Raw source MultipleLdaps · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 13476066-24d0-4b19-8fd5-28fe42ab35f6
name: MultipleLdaps
description: |
  Detect multiple Active Directory LDAP queries made in bin time
  Replace 10 on line 1 with your desired thershold
  Replace 1m on line 2 with your desired bin time
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - IdentityQueryEvents
query: |
  let Thershold = 10;
  let BinTime = 1m;
  IdentityQueryEvents
  | where ActionType == "LDAP query"
  | parse Query with * "Search Scope: " SearchScope ", Base Object:" BaseObject ", Search Filter: " SearchFilter
  | summarize NumberOfLdapQueries = count(), NumberOfDistinctLdapQueries = dcount(SearchFilter) by DeviceName, bin(Timestamp, BinTime)
  | where NumberOfDistinctLdapQueries > Thershold

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.