Active Directory Data Collection via LDAP


Description

In an Active Directory LDAP query, (objectGUID=*) is a search filter that evaluates to TRUE for every object in the directory, meaning it will return all objects. This may indicate an attempt to dump AD database using tools such as ADExplorer for offline analysis or exfiltration.

Query · eql

api where process.Ext.api.name == "ldap_search" and process.Ext.api.parameters.search_filter : ("(objectGUID=?)", "objectGUID=?")
Raw source Active Directory Data Collection via LDAP · Elastic TOML
Esc
Published by elastic/protections-artifacts ↗, licensed under Elastic License 2.0 ↗. Reproduced here unmodified.
[rule]
description = """
In an Active Directory LDAP query, (objectGUID=*) is a search filter that evaluates to TRUE for every object in the
directory, meaning it will return all objects. This may indicate an attempt to dump AD database using tools such as
ADExplorer for offline analysis or exfiltration.
"""
id = "e79d5328-16fc-45ea-8179-ea2746042af6"
license = "Elastic License v2"
name = "Active Directory Data Collection via LDAP"
os_list = ["windows"]
reference = ["https://learn.microsoft.com/en-us/windows/win32/adschema/a-objectguid"]
version = "1.0.3"

query = '''
api where process.Ext.api.name == "ldap_search" and process.Ext.api.parameters.search_filter : ("(objectGUID=?)", "objectGUID=?")
'''

min_endpoint_version = "9.1.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1069"
name = "Permission Groups Discovery"
reference = "https://attack.mitre.org/techniques/T1069/"
[[threat.technique.subtechnique]]
id = "T1069.002"
name = "Domain Groups"
reference = "https://attack.mitre.org/techniques/T1069/002/"


[[threat.technique]]
id = "T1087"
name = "Account Discovery"
reference = "https://attack.mitre.org/techniques/T1087/"
[[threat.technique.subtechnique]]
id = "T1087.002"
name = "Domain Account"
reference = "https://attack.mitre.org/techniques/T1087/002/"


[[threat.technique]]
id = "T1482"
name = "Domain Trust Discovery"
reference = "https://attack.mitre.org/techniques/T1482/"

[[threat.technique]]
id = "T1482"
name = "Domain Trust Discovery"
reference = "https://attack.mitre.org/techniques/T1482/"

[[threat.technique]]
id = "T1615"
name = "Group Policy Discovery"
reference = "https://attack.mitre.org/techniques/T1615/"


[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[internal]
min_endpoint_version = "9.1.0"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.