Forum Discussion

Tali Ash's avatar
Tali Ash
Icon for Microsoft rankMicrosoft
Feb 26, 2019

New preview detection: Security principal reconnaissance (LDAP)

We are proud to introduce a new alert in preview mode that addresses Security principal reconnaissance (LDAP).  This type of reconnaissance is typically used by attackers to gain critical information about the domain environment. 

Lightweight Directory Access Protocol (LDAP) is one the most popular methods used for both legitimate and malicious purposes to query Active Directory and is commonly used as the first phase of a Kerberoasting attack. Kerberoasting attacks are used to get a target list of Security Principal Names (SPNs), which attackers then attempt to get Ticket Granting Server (TGS) tickets for.

 

Starting from Version 2.67, Azure ATP now detects when suspicious LDAP enumeration queries are made or when queries targeted to sensitive groups that use methods not previously seen are observed. In order to allow Azure ATP to accurately profile and learn legitimate users, alerts of this type are only triggered first the first time 10 days following Azure ATP 2.67 version deployment.

 

For more information visit https://aka.ms/ldaprecon

 

Stay tuned for additional alerts and updates.  As always, your feedback is welcome.

  • echavez370's avatar
    echavez370
    Copper Contributor

    Are there any plans to update this alert to include what actor performed the query? It's very unhelpful to say "an actor on server sent a suspicious LDAP query" without specifying the actor. Tali Ash 

    • EliOfek's avatar
      EliOfek
      Icon for Microsoft rankMicrosoft
      We don't have the actor as this is happening using the machine account.
      If you have MDE on the machine you might have more data to cross with to find the actor.
      • mboisvert's avatar
        mboisvert
        Copper Contributor

        EliOfekSource? That would be useful if it was in the documentation of Msft and we don't need to ask on techcommunity. Do you have any suggestions to correlate this alert with factual events on the machine? That would be useful too. Thanks.

Resources