Suspicious LDAP-Attributes Used

Severity: high
Author: xknow @xknow_infosec
Source: upstream

Detects the usage of particular AttributeLDAPDisplayNames, which are known for data exchange via LDAP by the tool LDAPFragger and are additionally not commonly used in companies.

MITRE ATT&CK coverage

Tactic	Techniques
Command & Control	`T1001.003` Data Obfuscation: Protocol or Service Impersonation

Event coverage

Provider	Event ID	Title
Security-Auditing	5136	A directory service object was modified.

Stages and Predicates

Stage 1: `selection`

AttributeLDAPDisplayName: [otherFacsimileTelephoneNumber, primaryInternationalISDNNumber, primaryTelexNumber]
AttributeValue|contains: '*'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.