PasswordSearch

id: ba3da496-7559-4288-834e-8de26a90eb6e
name: PasswordSearch
description: |
  Detect Active Directory LDAP queries that search for users with comment or description that contains the string "pass" that might suggest for the user password
  This LDAP query cover MetaSploit - enum_ad_user_comments tool
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - IdentityQueryEvents
query: |
  let PersonObject = "objectCategory=person";
  let UserClass = "objectClass=user";
  let SamAccountUser = "samAccountType=805306368";
  let Description = "description=*pass*";
  let Comment = "comment=*pass*";
  IdentityQueryEvents
  | where ActionType == "LDAP query"
  | parse Query with * "Search Scope: " SearchScope ", Base Object:" BaseObject ", Search Filter: " SearchFilter
  | where (SearchFilter contains Description or SearchFilter contains Comment) and
  (SearchFilter contains PersonObject or SearchFilter contains UserClass or SearchFilter contains SamAccountUser)