LDAP Enumeration
Detects suspicious or excessive LDAP queries performed against Active Directory, as identified by Microsoft Defender for Identity. This behavior may indicate reconnaissance activity where an attacker attempts to gather information about users, groups, and domain structure for further exploitation
CQL · Falcon Next-Gen SIEMCopy query
#Vendor = "microsoft"
| #event.dataset="defender-identity.IdentityQueryEvents"
| event.action = "ldap query"
| groupBy([Vendor.properties.IPAddress,Vendor.properties.AdditionalFields.FROM.DEVICE], function=[count(as=ldap_queries),collect(fields=[Vendor.properties.DestinationDeviceName,Vendor.properties.Query,Vendor.properties.AdditionalFields.TARGET_OBJECT.ENTITY_USER,Vendor.properties.AdditionalFields.TARGET_OBJECT.GROUP,Vendor.properties.QueryTarget,Vendor.properties.TargetAccountUpn]),min(@timestamp, as=start_time),max(@timestamp, as=end_time)])
| ldap_queries > 50 //Adjust the value as per your enviorment
| time_diff_min := (end_time - start_time) / 60000
| time_diff_min <= 100 //Adjust the time as per your enviorment
| start_time_fmt := formatTime("%Y-%m-%d %H:%M:%S", field=start_time, timezone="UTC")
| end_time_fmt := formatTime("%Y-%m-%d %H:%M:%S", field=end_time, timezone="UTC")
| drop([start_time, end_time])
| sort([ldap_queries], order=desc)Detects suspicious or excessive LDAP queries performed against Active Directory, as identified by Microsoft Defender for Identity. This behavior may indicate reconnaissance activity where an attacker attempts to gather information about users, groups, and domain structure for further exploitation
ldap_enumeration.yml
T1087
Kundan Kumar
Detection
Identity
Identity
2026-05-08
2026-05-08
