GPO Settings Enumerated via LDAP Query

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•4

This rule detects attempts to enumerate Group Policy Object (GPO) settings by identifying LDAP queries containing the string "(objectClass=groupPolicyContainer)" over TCP port 389 (LDAP). This activity is often associated with reconnaissance or discovery phases of an attack, where an adversary is trying to understand the domain's GPO structure.