Reversible Password Encryption Enabled in AD
This rule detects network traffic indicating that reversible password encryption might be enabled in Active Directory. It specifically looks for the string "AllowReversiblePasswordEncryption" in TCP traffic destined for port 389 (LDAP). Enabling reversible password encryption stores passwords in a format that can be easily decrypted, making them vulnerable to theft if the system is compromised.
Suricata
