Mass LDAP enumeration indicative of modified BloodHound collector

Duo Tech@duotech

•updated Aug 27, 2026•7•0•9

Detects mass LDAP enumeration queries consistent with a modified BloodHound collector scraping AD users, computers, groups, and GPO/ACL data — customized by CISA's red team to evade static EDR signatures.