LDAP Enumeration Detection means watching for unusual LDAP queries sent to a Domain Controller to collect information about users, groups, computers, or admin accounts. Warning signs include: a large number of LDAP queries from one host in a short time, queries from a normal account (not a service account), and patterns that match tools like BloodHound. Combining Windows Event ID 4662/5136 on the DC with a SIEM (like Sentinel) helps you catch this early.
What is LDAP Enumeration?
LDAP Enumeration is a technique that uses the Lightweight Directory Access Protocol (LDAP) to query and collect information from an Active Directory Domain Controller (DC).
LDAP can be used to collect information such as:
- Users in the domain
- Groups and group members
- Privileged accounts
- Computer accounts
- Domain information
- Trust relationships
In the MITRE ATT&CK framework, this falls under Discovery: T1087.002 (Account Discovery: Domain Account) and T1069.002 (Permission Groups Discovery: Domain Groups).
Simulating LDAP Enumeration with bloodhound-python
In my lab, I used bloodhound-python — the Python version of the BloodHound collector. It runs on Kali Linux and does not need to be joined to the domain. It is an open-source tool, commonly used to assess AD security.
Step 1 — Install
pipx install bloodhound-pythonStep 2 — Run data collection
bloodhound-python -u administrator -p 'admin@123' -ns 10.10.10.10 -d domain.local -c DCOnlyWhere:
| Option | Meaning |
|---|---|
-u |
Username used to authenticate to LDAP |
-p |
Matching password |
-ns |
DNS server IP (usually the DC’s IP) |
-d |
Domain name (FQDN) |
-c DCOnly |
Only collect through LDAP/DC, skip touching each client — faster and quieter |
Example Output
┌──(truongnt㉿kali)-[~]
└─$ bloodhound-python -u administrator -p admin@123 -ns 10.10.10.10 -d domain.local
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: domain.local
INFO: Getting TGT for user
INFO: Connecting to LDAP server: dc1.domain.local
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 2 computers
INFO: Found 7 users
INFO: Connecting to LDAP server: dc1.domain.local
INFO: Found 52 groups
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: DCADCON.domain.local
INFO: Querying computer: DC1.domain.local
INFO: Done in 00M 00S
Signs of LDAP Enumeration in the Logs
When bloodhound-python -c DCOnly runs, the DC logs a large number of LDAP bind and search requests in a short time, from one single source. Some specific signs:
- Unusual volume: thousands of LDAP queries in a few seconds or minutes from one IP/host — a normal user rarely creates this pattern manually.
- Machine-like search filters: many enumeration tools use LDAP filters, such as scanning all
objectClass=userorobjectClass=groupobjects one after another. - Source is not a service account: a normal domain user running many LDAP queries in a row is suspicious.
- Related Windows Event IDs: 4768, 4769, 4624, 4634