LDAP Enumeration: Unveiling the Double-Edged Sword of Active Directory
Summary: Unit 42 published a practical guide to detecting LDAP-based attacks, noting that threat actors use LDAP for network enumeration during an attack's discovery phase to extract user accounts, group memberships and permissions. The article cites Stately Taurus using AdFind against Southeast Asian government entities from 2021 to 2023 (renaming adfind.exe to a.logs to evade detection), BlackCat/ALPHV affiliates tracked as Ambitious Scorpius using ADRecon, and SharpHound used in an April 2024 IcedID and Dagon Locker intrusion described by The DFIR Report.
Why it matters: A domain controller's high volume of benign LDAP logs - Outlook alone generates them - means malicious enumeration can disappear into normal operations, so the detection signal Unit 42 points to is behavioral: broad queries that visit and return far more entries than legitimate ones.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026