huntrule

Suspicious LDAP Query Enumerating Kerberos Preauth Disabled Accounts with Whitespace Evasion

PremiumReviewedSigma · Medium · v1
Product
windows
Service
security
Author
HuntRule
Published
2026-10-01
Updated
2026-10-01
AnalysisDetection

ATT&CK techniques

Cred Access → Discovery

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects Directory Service event 1644 LDAP search filters that test the userAccountControl DONT_REQ_PREAUTH bit 524288, tolerating whitespace permutations that attackers insert to evade naive signatures. Enumerating accounts with Kerberos pre-authentication disabled is the reconnaissance step preceding AS-REP roasting. The whitespace-tolerant match captures the same intent even when the filter is padded to break exact-string detections.

Reporting behind it

Related detections9 linkedT1087.002 — drag to rearrange
Suspicious SOAPHound Style LDAP Query with SDflags and all_with_list via security
Suspicious SOAPHound Null Filter LDAP Query via security
Suspicious Active Directory Web Services Query from Localhost via SOAPHound
Suspicious LDAP Security Descriptor Enumeration via SD_FLAGS Control
Suspicious Delegation Discovery LDAP Search Filter via Bitwise OID
Suspicious Kerberoasting LDAP Search Filter for Service Principal Names
Suspicious PowerShell Execution of Untitled1 Script From ProgramData
Suspicious Notepad Access to Active Directory Enumeration Output Files
Suspicious Service Principal Name Discovery via setspn Query
Suspicious LDAP Query Enumerating Kerberos Preauth Disabled Accounts with Whitespace Evasion
Pivot detection · T1087.002 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.