Suspicious_LDAP_queries.kql

let timeframe = 30d;
let suspect_search_filter=dynamic([
// Generic Active Directory reconnaissance signature
"objectGUID=*",
// Sharphound IOCs
"(schemaIDGUID=*)","(&(objectclass=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))","(|(samAccountType=805306368)(samAccountType=805306369)(objectclass=organizationalUnit))",
"(|(samaccounttype=268435456)(samaccounttype=268435457)(samaccounttype=536870912)(samaccounttype=536870913))","(samAccountType=805306368)(samAccountType=805306369)"]);
DeviceEvents
| where ingestion_time() >= ago(timeframe)
| where ActionType contains "LdapSearch"
| where InitiatingProcessAccountName != "noisy_account" and InitiatingProcessAccountName != "noisy_account2"
| extend AdditionalFields=parse_json(AdditionalFields)
| extend SearchFilter=tostring(AdditionalFields.SearchFilter)
| where SearchFilter has_any(suspect_search_filter)
| project-reorder DeviceName, InitiatingProcessFolderPath, SearchFilter, InitiatingProcessCommandLine, InitiatingProcessAccountName