Caught in the Act: CrowdStrike’s New ML-Powered LDAP Reconnaissance Detections

The report outlines CrowdStrike’s new AI-based detection for early reconnaissance in Active Directory by generating LDAP search signatures within Falcon Identity Protection. It explains how LDAP is commonly used for directory queries that attackers leverage during recon, highlights the challenge of separating legitimate from malicious activity, and underscores the value of behavioral baselining to spot suspicious queries, including those from tools like SharpHound and Rubeus.