Rule Info
Name
PowerShell Script With LDAP Query Capabilities
Author
Nasreddine Bencherchali (Nextron Systems)
Description
Detects the execution of a PowerShell script that leverage the "ActiveDirectory" .NET class for potential LDAP reconnaissance activity.
Date
2024-02-28 00:00:00
Modified
None
Id
6072018f-fdf7-4588-9ddd-d708af11d63f
Tags
attack.discovery attack.t1018
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR