Uncovering Adversarial LDAP Tradecraft

This joint TrustedSec and Binary Defense write-up examines adversarial LDAP tradecraft in Active Directory, contrasting normal versus suspicious query patterns (e.g., broad objectClass=* pulls, Kerberoasting, reconnaissance filters), and introduces LDAPMon to collect client-side LDAP telemetry via the Windows-LDAP-Client ETW provider alongside Sysmon. It provides practical detection guidance—baseline SYSTEM/Local Service/Network Service activity, correlate LDAP queries with process lineage and network connections (including C2 via execute-assembly/InlineExecute-Assembly), focus on outliers, and iteratively expand coverage—while warning about ETW tampering (patching EtwEventWrite) that can blind telemetry.