Microsoft Defender for Identity

Reported Context (2)

Discovery Staged runtimes query host configuration and interact with domain infrastructure. Microsoft Defender for Identity Microsoft Details Teams Support-Impersonation Intrusions Using AD CS ESC1 and ESC8
Microsoft Defender for Identity added detection 2437 in version 2.228 (February 2024) specifically for LDAP Ping enumeration. The MDI documentation describes it as detecting LDAP search activities from sensors running Detecting Active Directory LDAP Ping: Correlating Netlogon Logs and Event 5156

People (2)

MITRE ATT&CK (14)

Vendors (1)

Products (8)

Tools (5)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.