Domain Trust Enumeration via LDAP Query
This rule detects attempts to enumerate domain trusts by querying LDAP for objects with the 'objectClass=trustedDomain' attribute. This activity is often performed by attackers during the discovery phase to map out the network topology and identify potential lateral movement paths. The rule specifically looks for TCP traffic to port 389 (LDAP) on the home network, containing the specified LDAP filter, and uses a threshold to prevent excessive alerts from legitimate, but frequent, queries.
Suricata
