Hunt For All Executed LDAP Queries From A Compromised Device
Description
This KQL query will list all executed LDAP quieries from a compromised device.
Query
Microsoft Defender For Endpoint
Kusto
let CompromisedDevice = "laptop1.com";
let SearchWindow = 48h; //Customizable h = hours, d = days
IdentityQueryEvents
| where Timestamp > ago(SearchWindow)
| where DeviceName == CompromisedDevice
| where Protocol == "Ldap"
| project
Timestamp,
QueryType,
Query,
Protocol,
DeviceName,
DestinationDeviceName,
TargetAccountUpnMicrosoft Sentinel
Kusto
let CompromisedDevice = "laptop1.com";
let SearchWindow = 48h; //Customizable h = hours, d = days
IdentityQueryEvents
| where TimeGenerated > ago(SearchWindow)
| where DeviceName == CompromisedDevice
| where Protocol == "Ldap"
| project
TimeGenerated,
QueryType,
Query,
Protocol,
DeviceName,
DestinationDeviceName,
TargetAccountUpn