LDAP Reconnaissance – the foundation of Active Directory attacks

Eric, there are services that run commands to query sensitive groups including "Domain Admins". For example Exchange services run this query for legitimate use getting the account who may manage the service. Therefore, not any query to Domain Admin is a malicious activity and Azure ATP will alert on suspicious queries which are less common in the environment.