LDAP: attacks, enumeration & AD exploitation

LDAP (Lightweight Directory Access Protocol) is a standard protocol used to query and modify directory services, most notably Microsoft Active Directory. LDAP operates over TCP port 389 and LDAPS (TLS-secured) over port 636. In Active Directory environments, LDAP is the primary mechanism through which clients resolve user objects, group memberships, computer accounts, GPOs, and Service Principal Names. Every domain-joined machine communicates via LDAP constantly. This makes it a high-value target for attackers. Without proper access controls, LDAP exposes an enormous amount of directory data. Anonymous binds, a legacy configuration, allow unauthenticated clients to query the directory. Even authenticated low-privilege users can enumerate nearly all objects by default in Active Directory. Attackers leverage this to map the domain topology, identify privileged accounts, and locate attack paths before executing privilege escalation. Understanding how LDAP works at the protocol level is essential for both defenders building detection logic and red teamers planning initial reconnaissance inside a domain.

Detecting LDAP abuse in a SOC context requires monitoring at multiple layers. On domain controllers, Windows Event ID 1644 logs expensive, inefficient, or unsupported LDAP queries when the relevant registry diagnostic key is enabled under HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics. Network-level detection should flag high-volume LDAP query bursts from a single host, particularly queries targeting sensitive attributes like userAccountControl, pwdLastSet, memberOf, or servicePrincipalName. Tools such as Zeek or Suricata can parse LDAP traffic and generate alerts on anomalous patterns. LDAP anonymous bind attempts should trigger immediate alerts since modern environments have no legitimate use for them. BloodHound collection activity is detectable via its characteristic LDAP query patterns, including bulk enumeration of all domain computers and users in rapid succession. Netflow data showing a workstation opening dozens of LDAP sessions to a domain controller within seconds is a reliable indicator of automated enumeration. SIEM correlation rules should baseline normal LDAP query volumes per host and alert on statistical deviations exceeding two to three standard deviations from that baseline.

Red teamers use LDAP extensively during the reconnaissance and lateral movement phases of an engagement. The ldapsearch command-line tool performs raw LDAP queries against a domain controller, extracting all user objects, group policies, trusts, and ACL configurations with a single authenticated bind. PowerView functions such as Get-DomainUser and Get-DomainGroupMember wrap LDAP queries in PowerShell and are widely used in offensive tooling. BloodHound with its SharpHound collector automates LDAP enumeration to build attack path graphs, identifying paths from low-privilege users to Domain Admin. LDAP injection targets web applications or scripts that construct LDAP filters from unsanitized user input, allowing filter manipulation to bypass authentication or extract arbitrary directory entries. Credential-based attacks such as password spraying are staged using LDAP bind requests to avoid Kerberos pre-authentication logging. Mitigations include disabling anonymous binds via the dsHeuristics attribute, enforcing LDAP signing and channel binding through GPO (KB4520412), restricting who can read sensitive attributes via AD ACLs, and deploying Microsoft Defender for Identity to detect enumeration patterns at the directory level.