Sigma rule: DNS Server Discovery Via LDAP Query

Rule

Title

DNS Server Discovery Via LDAP Query

Status

test

Level

low

Author

frack113

Date

2022-08-20

Modified

2023-09-18

File

rules/windows/dns_query/dns_query_win_dns_server_discovery_via_ldap_query.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects DNS server discovery via LDAP query requests from uncommon applications

Log source

product

windows

category

dns_query

Detection

selection:
    QueryName|startswith: '_ldap.'
filter_main_generic:
    Image|contains:
        - ':\Program Files\'
        - ':\Program Files (x86)\'
        - ':\Windows\'
filter_main_defender:
    Image|contains: ':\ProgramData\Microsoft\Windows Defender\Platform\'
    Image|endswith: '\MsMpEng.exe'
filter_main_unknown:
    Image: '<unknown process>'
filter_optional_azure:
    Image|startswith: 'C:\WindowsAzure\GuestAgent'
filter_main_null:
    Image: null
filter_optional_browsers:
    # Note: This list is for browsers installed in the user context. To avoid basic evasions based on image name. Best to baseline this list with the browsers you use internally and add their full paths.
    Image|endswith:
        - '\chrome.exe'
        - '\firefox.exe'
        - '\opera.exe'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Likely

Tags

• attack.discovery
• attack.t1482

MITRE ATT&CK ids this rule names

• T1482

References

• https://github.com/redcanaryco/atomic-red-team/blob/980f3f83fd81f37c1ca9c02dccfd1c3d9f9d0841/atomics/T1016/T1016.md#atomic-test-9---dns-server-discovery-using-nslookup
• https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/7fcdce70-5205-44d6-9c3a-260e616a2f04

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/dns_query/dns_query_win_dns_server_discovery_via_ldap_query.yml