Windows LDAP Client Event ID 30 Active Directory enumeration via LDAP search filters
Flags LDAP search queries indicative of Active Directory reconnaissance/enumeration using Event ID 30 filter patterns.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Service
- ldap
- Author
- Adeem Mawani (SigmaHQ), DRL 1.1
- Published
- 2021-06-22
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows LDAP client activity that uses LDAP search filters associated with querying Active Directory objects and relationships. Such reconnaissance and enumeration can help attackers map users, groups, privileged accounts, and policy-related objects before follow-on access. It relies on Microsoft-Windows-LDAP-Client/Debug ETW telemetry (Event ID 30), matching specific LDAP SearchFilter patterns and DistinguishedName content indicative of directory discovery.
Reporting behind it
- techcommunity.microsoft.comhttps://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/hunting-for-reconnaissance-activities-using-ldap-search-filters/ba-p/824726
- github.comhttps://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/Recon/PowerView.ps1
- github.comhttps://github.com/BloodHoundAD/SharpHound3/blob/7d96b991b1887ff50349ce59c80980bc0d95c86a/SharpHound3/LdapBuilder.cs
- medium.comhttps://medium.com/falconforce/falconfriday-detecting-active-directory-data-collection-0xff21-c22d1a57494c
- github.comhttps://github.com/fox-it/BloodHound.py/blob/d65eb614831cd30f26028ccb072f5e77ca287e0b/bloodhound/ad/domain.py#L427
- ipurple.teamhttps://ipurple.team/2024/07/15/sharphound-detection/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/ldap/win_ldap_recon.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-ldap-recon-detect-ad-enumeration-via-ldap-search-filters-event-id-30-31d68132
title: Windows LDAP Client Event ID 30 Active Directory enumeration via LDAP search filters
id: 2b5f5f31-45d2-4e77-aa83-97ddf834aa6e
status: test
description: This rule flags Windows LDAP client activity that uses LDAP search filters associated with querying Active Directory objects and relationships. Such reconnaissance and enumeration can help attackers map users, groups, privileged accounts, and policy-related objects before follow-on access. It relies on Microsoft-Windows-LDAP-Client/Debug ETW telemetry (Event ID 30), matching specific LDAP SearchFilter patterns and DistinguishedName content indicative of directory discovery.
references:
- https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/hunting-for-reconnaissance-activities-using-ldap-search-filters/ba-p/824726
- https://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/Recon/PowerView.ps1
- https://github.com/BloodHoundAD/SharpHound3/blob/7d96b991b1887ff50349ce59c80980bc0d95c86a/SharpHound3/LdapBuilder.cs
- https://medium.com/falconforce/falconfriday-detecting-active-directory-data-collection-0xff21-c22d1a57494c
- https://github.com/fox-it/BloodHound.py/blob/d65eb614831cd30f26028ccb072f5e77ca287e0b/bloodhound/ad/domain.py#L427
- https://ipurple.team/2024/07/15/sharphound-detection/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/ldap/win_ldap_recon.yml
author: Adeem Mawani, Huntrule Team
date: 2021-06-22
modified: 2025-07-04
tags:
- attack.discovery
- attack.t1069.002
- attack.t1087.002
- attack.t1482
logsource:
product: windows
service: ldap
definition: "Requirements: Microsoft-Windows-LDAP-Client/Debug ETW logging"
detection:
generic_search:
EventID: 30
SearchFilter|contains:
- (groupType:1.2.840.113556.1.4.803:=2147483648)
- (groupType:1.2.840.113556.1.4.803:=2147483656)
- (groupType:1.2.840.113556.1.4.803:=2147483652)
- (groupType:1.2.840.113556.1.4.803:=2147483650)
- (sAMAccountType=805306369)
- (sAMAccountType=805306368)
- (sAMAccountType=536870913)
- (sAMAccountType=536870912)
- (sAMAccountType=268435457)
- (sAMAccountType=268435456)
- (objectCategory=groupPolicyContainer)
- (objectCategory=organizationalUnit)
- (objectCategory=nTDSDSA)
- (objectCategory=server)
- (objectCategory=domain)
- (objectCategory=person)
- (objectCategory=group)
- (objectCategory=user)
- (objectClass=trustedDomain)
- (objectClass=computer)
- (objectClass=server)
- (objectClass=group)
- (objectClass=user)
- (primaryGroupID=521)
- (primaryGroupID=516)
- (primaryGroupID=515)
- (primaryGroupID=512)
- Domain Admins
- objectGUID=\*
- (schemaIDGUID=\*)
- admincount=1
distinguished_name_enumeration:
EventID: 30
SearchFilter: (objectclass=\*)
DistinguishedName|contains:
- CN=Domain Admins
- CN=Enterprise Admins
- CN=Group Policy Creator Owners
suspicious_flag:
EventID: 30
SearchFilter|contains:
- (userAccountControl:1.2.840.113556.1.4.803:=4194304)
- (userAccountControl:1.2.840.113556.1.4.803:=2097152)
- "!(userAccountControl:1.2.840.113556.1.4.803:=1048574)"
- (userAccountControl:1.2.840.113556.1.4.803:=524288)
- (userAccountControl:1.2.840.113556.1.4.803:=65536)
- (userAccountControl:1.2.840.113556.1.4.803:=8192)
- (userAccountControl:1.2.840.113556.1.4.803:=544)
- "!(UserAccountControl:1.2.840.113556.1.4.803:=2)"
- msDS-AllowedToActOnBehalfOfOtherIdentity
- msDS-AllowedToDelegateTo
- msDS-GroupManagedServiceAccount
- (accountExpires=9223372036854775807)
- (accountExpires=0)
- (adminCount=1)
- ms-MCS-AdmPwd
narrow_down_filter:
EventID: 30
SearchFilter|contains:
- (domainSid=*)
- (objectSid=*)
condition: (generic_search and not narrow_down_filter) or suspicious_flag or distinguished_name_enumeration
level: medium
license: DRL-1.1
related:
- id: 31d68132-4038-47c7-8f8e-635a39a7c174
type: derived