Detecting Active Directory Attack-Path Enumeration with SDFlags
Summary
The article explains how SDFlags in Event ID 1644 can help detect SharpHound-style mass LDAP enumeration of nTSecurityDescriptor, and shares tested patterns and sample detection logic for defenders.
Key points
- SDFlags appears in Event ID 1644 when LDAP queries request the nTSecurityDescriptor attribute.
- The SDFlags control selects which security descriptor components are returned; 0x4 requests the DACL, while 0x5 requests the owner and DACL.
- SharpHound testing showed 0x4 in general enumeration and 0x5 for groups and certificate templates.
- The author reports that mass LDAP enumeration combining nTSecurityDescriptor and SDFlags can indicate attack-path discovery.
- The article provides sample detection logic using Event ID 1644, LDAP filter patterns, search scope, and source connection fields.
- The author recommends baselining environments because legitimate tools or security research activity may also use SDFlags.
Article Details
- Defense Focus
- Detect LDAP-based Active Directory attack-path enumeration by identifying Event ID 1644 searches that request nTSecurityDescriptor with the SDFlags control, especially mass enumeration and group queries using SDFlags 0x5.
- Detection Methods
- Correlate Event ID 1644, nTSecurityDescriptor requests, SDFlags values, LDAP filter patterns, and search scope; treat mass enumeration of 100 or more objects with SDFlags as a strong attack-path-discovery signal.
- Prioritize the combination of SDFlags 0x5 and group-enumeration sAMAccountType filters as a pattern the author observed in SharpHound activity.
- Baseline legitimate directory activity: specific-object queries with basic attributes and no SDFlags were contrasted with SharpHound mass enumeration.
- Filter out local domain-controller operations using the source IP-and-port field, and adjust the example detection logic to the SIEM's field mappings.
- Data Sources
- Active Directory Directory Service Event ID 1644 logs, including LDAP filter, requested attributes, SearchScope, SearchFlags/SDFlags, and source IP:port.
- Event ID 5156 is mentioned as a possible source for source-IP attribution in a related article, but no correlation procedure is provided here.
- Rule Types
- Elastic Common Schema (ECS) detection-logic excerpt matching Event ID 1644, group sAMAccountType filters, subtree scope, SDFlags, and remote source IP:port.
- Platforms
- Active Directory
- Defensive Actions
- Baseline SDFlags use in the environment before deploying alerts; the author reports that legitimate admin activity rarely used it in their testing.
- Alert on mass LDAP enumeration that requests nTSecurityDescriptor with SDFlags, while considering object scope and requested attributes.
- Investigate SDFlags 0x5 group-enumeration events and validate whether they represent authorized SharpHound or other security-research activity.
- Avoid treating a single-object nTSecurityDescriptor query as equivalent to mass enumeration; consider query volume and scope.
MITRE ATT&CK
T1018 · Remote System DiscoverySharpHound collection includes LDAP enumeration of computer objects and their security descriptors.T1069.001 · Local GroupsSharpHound enumerates Active Directory users and their permissions as part of its directory collection.T1069.002 · Domain GroupsSharpHound queries Active Directory group membership and security descriptors to enumerate group and permission relationships for attack-path discovery.
People
Vendors
Products
BloodHoundThe "aha!" moment: This is how BloodHound worksElastic Common SchemaField names use Elastic Common Schema (ECS).Microsoft Active DirectoryAs FalconForce explains in their SOAPHound blog post, when you query nTSecurityDescriptor without SDFlags, Active Directory tries to return all four components by default (Owner, Group, DACL, and SACL).SharpHoundFigure 1: SharpHound group enumeration query captured in Event ID 1644, showing SDFlags:0x5 (Owner + DACL) and the characteristic sAMAccountType filter for all group types.