← Back to SOC feed Coverage →

PasswordSearch

kql MEDIUM Azure-Sentinel
IdentityQueryEvents
huntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-09T11:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries may use LDAP queries to search for users with specific comments or descriptions to identify potential targets or credentials. SOC teams should proactively hunt for this behavior in Azure Sentinel to detect reconnaissance efforts and potential credential harvesting attempts.

KQL Query

let PersonObject = "objectCategory=person";
let UserClass = "objectClass=user";
let SamAccountUser = "samAccountType=805306368";
let Description = "description=*pass*";
let Comment = "comment=*pass*";
IdentityQueryEvents
| where ActionType == "LDAP query"
| parse Query with * "Search Scope: " SearchScope ", Base Object:" BaseObject ", Search Filter: " SearchFilter
| where (SearchFilter contains Description or SearchFilter contains Comment) and
(SearchFilter contains PersonObject or SearchFilter contains UserClass or SearchFilter contains SamAccountUser)

Analytic Rule Definition

id: ba3da496-7559-4288-834e-8de26a90eb6e
name: PasswordSearch
description: |
  Detect Active Directory LDAP queries that search for users with comment or description that contains the string "pass" that might suggest for the user password
  This LDAP query cover MetaSploit - enum_ad_user_comments tool
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - IdentityQueryEvents
query: |
  let PersonObject = "objectCategory=person";
  let UserClass = "objectClass=user";
  let SamAccountUser = "samAccountType=805306368";
  let Description = "description=*pass*";
  let Comment = "comment=*pass*";
  IdentityQueryEvents
  | where ActionType == "LDAP query"
  | parse Query with * "Search Scope: " SearchScope ", Base Object:" BaseObject ", Search Filter: " SearchFilter
  | where (SearchFilter contains Description or SearchFilter contains Comment) and
  (SearchFilter contains PersonObject or SearchFilter contains UserClass or SearchFilter contains SamAccountUser)

Required Data Sources

Sentinel TableNotes
IdentityQueryEventsEnsure this data connector is enabled

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Discovery/PasswordSearch.yaml