LDAP Enumeration: Unveiling the Double-Edged Sword of Active Directory

This Unit 42 report examines how threat actors — including APT groups and ransomware affiliates — abuse LDAP/Active Directory for reconnaissance and enumeration, documents real-world usages of tools like AdFind, ADRecon, and SharpHound, highlights logging and detection challenges (high-volume benign LDAP noise), and provides practical detection strategies, notable LDAP attributes to monitor, and an XQL query for Cortex XDR to identify suspicious LDAP activity.