Windows DNS Server Discovery via LDAP Query to _ldap.<domain>

title: Windows DNS Server Discovery via LDAP Query to _ldap.<domain>
id: f848cf2b-5e5d-4956-a45f-ed796f3de698
status: test
description: This rule flags DNS queries whose QueryName starts with "_ldap." while originating from processes that are not commonly seen in a typical Windows environment. LDAP-related DNS discovery can be used by attackers to locate directory services and configuration information needed for further actions. The detection relies on Windows DNS query telemetry (QueryName) and process path/identity context to filter out known benign binaries and common automation hosts.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/980f3f83fd81f37c1ca9c02dccfd1c3d9f9d0841/atomics/T1016/T1016.md#atomic-test-9---dns-server-discovery-using-nslookup
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/7fcdce70-5205-44d6-9c3a-260e616a2f04
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_dns_server_discovery_via_ldap_query.yml
author: frack113, Huntrule Team
date: 2022-08-20
modified: 2023-09-18
tags:
  - attack.discovery
  - attack.t1482
logsource:
  product: windows
  category: dns_query
detection:
  selection:
    QueryName|startswith: _ldap.
  filter_main_generic:
    Image|contains:
      - :\Program Files\
      - :\Program Files (x86)\
      - :\Windows\
  filter_main_defender:
    Image|contains: :\ProgramData\Microsoft\Windows Defender\Platform\
    Image|endswith: \MsMpEng.exe
  filter_main_unknown:
    Image: <unknown process>
  filter_optional_azure:
    Image|startswith: C:\WindowsAzure\GuestAgent
  filter_main_null:
    Image: null
  filter_optional_browsers:
    Image|endswith:
      - \chrome.exe
      - \firefox.exe
      - \opera.exe
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Likely
level: low
license: DRL-1.1
related:
  - id: a21bcd7e-38ec-49ad-b69a-9ea17e69509e
    type: derived