Windows DNS Query for _ldap.* Using LDAP-Related Discovery
Alerts on _ldap.* DNS queries from uncommon Windows processes, indicating potential LDAP/DNS service discovery.
- Product
- windows
- Category
- dns_query
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-08-20
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows DNS queries with a QueryName starting with "_ldap." that are generated by processes outside common baselines. Attackers may use LDAP-related discovery patterns that involve resolving service records via DNS to locate directory services or related infrastructure. The detection relies on DNS query telemetry and process image path context, excluding known benign system and browser/agent images and allowing visibility into unknown or uncommon callers.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/980f3f83fd81f37c1ca9c02dccfd1c3d9f9d0841/atomics/T1016/T1016.md#atomic-test-9---dns-server-discovery-using-nslookup
- learn.microsoft.comhttps://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/7fcdce70-5205-44d6-9c3a-260e616a2f04
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_dns_server_discovery_via_ldap_query.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows DNS Query for _ldap.* Using LDAP-Related Discovery
id: f848cf2b-5e5d-4956-a45f-ed796f3de698
status: test
description: This rule flags Windows DNS queries with a QueryName starting with "_ldap." that are generated by processes outside common baselines. Attackers may use LDAP-related discovery patterns that involve resolving service records via DNS to locate directory services or related infrastructure. The detection relies on DNS query telemetry and process image path context, excluding known benign system and browser/agent images and allowing visibility into unknown or uncommon callers.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/980f3f83fd81f37c1ca9c02dccfd1c3d9f9d0841/atomics/T1016/T1016.md#atomic-test-9---dns-server-discovery-using-nslookup
- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/7fcdce70-5205-44d6-9c3a-260e616a2f04
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_dns_server_discovery_via_ldap_query.yml
author: frack113, Huntrule Team
date: 2022-08-20
modified: 2023-09-18
tags:
- attack.discovery
- attack.t1482
logsource:
product: windows
category: dns_query
detection:
selection:
QueryName|startswith: _ldap.
filter_main_generic:
Image|contains:
- :\Program Files\
- :\Program Files (x86)\
- :\Windows\
filter_main_defender:
Image|contains: :\ProgramData\Microsoft\Windows Defender\Platform\
Image|endswith: \MsMpEng.exe
filter_main_unknown:
Image: <unknown process>
filter_optional_azure:
Image|startswith: C:\WindowsAzure\GuestAgent
filter_main_null:
Image: null
filter_optional_browsers:
Image|endswith:
- \chrome.exe
- \firefox.exe
- \opera.exe
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Likely
level: low
license: DRL-1.1
related:
- id: a21bcd7e-38ec-49ad-b69a-9ea17e69509e
type: derived