Windows Security Event 5136: Suspicious LDAP attribute display names used
Alerts on Event 5136 containing specific LDAP display names indicative of LDAP-based data exchange.
- Product
- windows
- Service
- security
- Author
- xknow @xknow_infosec (SigmaHQ), DRL 1.1
- Published
- 2019-03-24
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags Windows Security events (EventID 5136) where LDAP attribute display names match a small set often associated with LDAP-based data exchange. Attackers may use these attribute names to blend into directory traffic while exfiltrating or exchanging command-and-control data. It relies on Security audit telemetry that records Directory Service changes, specifically the AttributeLDAPDisplayName and AttributeValue fields.
Reporting behind it
- medium.comhttps://medium.com/@ivecodoe/detecting-ldapfragger-a-newly-released-cobalt-strike-beacon-using-ldap-for-c2-communication-c274a7f00961
- blog.fox-it.comhttps://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes/
- github.comhttps://github.com/fox-it/LDAPFragger
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_ldap_dataexchange.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Security Event 5136: Suspicious LDAP attribute display names used"
id: 0adfc62a-1a8e-4e1c-813a-cb5c893f8d3c
status: test
description: This rule flags Windows Security events (EventID 5136) where LDAP attribute display names match a small set often associated with LDAP-based data exchange. Attackers may use these attribute names to blend into directory traffic while exfiltrating or exchanging command-and-control data. It relies on Security audit telemetry that records Directory Service changes, specifically the AttributeLDAPDisplayName and AttributeValue fields.
references:
- https://medium.com/@ivecodoe/detecting-ldapfragger-a-newly-released-cobalt-strike-beacon-using-ldap-for-c2-communication-c274a7f00961
- https://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes/
- https://github.com/fox-it/LDAPFragger
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_ldap_dataexchange.yml
author: xknow @xknow_infosec, Huntrule Team
date: 2019-03-24
modified: 2022-10-05
tags:
- attack.t1001.003
- attack.command-and-control
logsource:
product: windows
service: security
definition: The "Audit Directory Service Changes" logging policy must be configured in order to receive events. Audit events are generated only for objects with configured system access control lists (SACLs). Audit events are generated only for objects with configured system access control lists (SACLs) and only when accessed in a manner that matches their SACL settings. This policy covers the following events ids - 5136, 5137, 5138, 5139, 5141. Note that the default policy does not cover User objects. For that a custom AuditRule need to be setup (See https://github.com/OTRF/Set-AuditRule)
detection:
selection:
EventID: 5136
AttributeValue|contains: "*"
AttributeLDAPDisplayName:
- primaryInternationalISDNNumber
- otherFacsimileTelephoneNumber
- primaryTelexNumber
condition: selection
falsepositives:
- Companies, who may use these default LDAP-Attributes for personal information
level: high
license: DRL-1.1
related:
- id: d00a9a72-2c09-4459-ad03-5e0a23351e36
type: derived