VulnComputers

Description

Detect Active Directory LDAP queries that try to find operating systems that are vulnerable to specific vulnerabilities This LDAP query cover MetaSploit - enum_ad_computers tool

Query · kql

let ComputerObject = "objectCategory=computer";
let ComputerClass = "objectClass=computer";
let SamAccountComputer = "sAMAccountType=805306369";
let OperatingSystem = "operatingSystem=";
IdentityQueryEvents
| where ActionType == "LDAP query"
| parse Query with * "Search Scope: " SearchScope ", Base Object:" BaseObject ", Search Filter: " SearchFilter
| where (SearchFilter contains ComputerObject or SearchFilter contains ComputerClass or SearchFilter contains SamAccountComputer) and
 SearchFilter contains OperatingSystem
Raw source VulnComputers · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: ab8b5893-0c82-4a8c-ae19-43669b3d1eba
name: VulnComputers
description: |
  Detect Active Directory LDAP queries that try to find operating systems that are vulnerable to specific vulnerabilities
  This LDAP query cover MetaSploit - enum_ad_computers tool
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - IdentityQueryEvents
query: |
  let ComputerObject = "objectCategory=computer";
  let ComputerClass = "objectClass=computer";
  let SamAccountComputer = "sAMAccountType=805306369";
  let OperatingSystem = "operatingSystem=";
  IdentityQueryEvents
  | where ActionType == "LDAP query"
  | parse Query with * "Search Scope: " SearchScope ", Base Object:" BaseObject ", Search Filter: " SearchFilter
  | where (SearchFilter contains ComputerObject or SearchFilter contains ComputerClass or SearchFilter contains SamAccountComputer) and
   SearchFilter contains OperatingSystem

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.