The OID Problem: Writing LDAP Detections That Actually Work

This post details a systematic detection-engineering approach for Active Directory LDAP reconnaissance: analyze attacker source (Impacket), emulate in a lab to generate real telemetry, inspect Event 1644 logs to discover Microsoft’s OID-to-bitwise transformation (e.g., 1.2.840.113556.1.4.803 -> &), and build/validate Sigma-style rules (with examples) that target the logged bitwise syntax and attribute combinations to reliably detect reconnaissance behaviors like user/computer enumeration, Kerberoasting prep, DCSync prep, and delegation discovery.