From Code to Coverage (Part 6): What netlogon.log Sees That Event 1644 Never Will

This analysis demonstrates that LDAP Ping (cLDAP) username-enumeration can be performed anonymously against Domain Controllers and that detection depends on transport: ldapnomnom (TCP) can be attributed via Windows Filtering Platform Event 5156, while true UDP cLDAP evades 5156 and only appears in netlogon.log (which lacks source IP), creating a logging blind spot; the report validates these behaviors in lab testing, outlines detection methods (netlogon.log, Event 5156, MDI packet sensors), and recommends enabling netlogon debug, WFP auditing, MDI sensors, and correlating logs to detect and attribute such reconnaissance.