Custom signature for catch specific query

jsv93 — Wed, 08 Dec 2021 18:45:51 GMT

Hello all

I'm trying to catch suspicious ldap queries (recon activity).
For the example I want catch this kind of querie : (primaryGroupID=512)

I tried to make a custom rule. However for ldap, there are only 2 possibilities:
- ldap-req-searchrequest-baseobject
- ldap-rsp-searchresentry-objectname
both of them don't fit my needs cause they don't match the filter field.

I tried with unknown-req-tcp-payload but it did not work. Reading the forum I understood that I can't use this context since ldap is seen as a known application.
https://live.paloaltonetworks.com/t5/custom-signatures/custom-threat-signature-search-full-tcp-payload-of-any-appid/td-p/349450

So I'm running out of ideas to catch this kind of request.

If somebody have a tips

Thank's

topic Custom signature for catch specific query in Custom Signatures

Custom signature for catch specific query

Re: Custom signature for catch specific query