Defending Your Directory: An Expert Guide to Fortifying Active Directory Against LDAP Injection Threats

In our latest technical blog series, our DFIR team are highlighting the most prominent Active Directory (AD) threats, describing the tell-tale signs that your AD might be at risk, and give experienced insight into the best prevention and mitigation strategies to shore up your AD security and bolster your digital identity protection.

Last time we entered the labyrinth of Active Directory Certificate Services (AD CS) attacks. Up next, we're stepping into the shadowy realm of LDAP-based attacks - where the very protocol designed to streamline directory access can become an attacker's playground.

Definition:

LDAP (Lightweight Directory Access Protocol) is a protocol used for accessing and maintaining distributed directory information services over a network. It is mainly used for locating various entities such as organizations, individuals, and resources, like files and devices, within both public and private networks. Compared to its predecessor, DAP, LDAP offers a streamlined approach with a smaller code footprint. 

The LDAP directories are designed to be distributed across several servers. Each server houses a replicated and synchronized version of the directory, known as a Directory System Agent (DSA). The LDAP server handles all requests and may communicate with other DSAs to provide a unified response.

The LDAP directory is organized like a tree. At the top is the root directory, which branches out to countries. These further divide into organizations, then into organizational units representing various divisions or departments, and finally down to individual entities, including people and shared resources like files and printers.

How the attack works:

LDAP reconnaissance is a technique used by attackers to gather information about an Active Directory (AD) environment. Find below the steps of how it typically works:

1. Initial access: An attacker gains access to the network, often through phishing, exploiting vulnerabilities, or using stolen credentials.
2. LDAP queries: The attacker uses LDAP queries to extract information from the AD. LDAP is used for accessing and maintaining directory information services, making it a valuable tool for attackers.
3. Information gathering: Through these queries, the attacker can gather detailed information about the network, including:
   1. Users and Groups: Identifying user accounts, group memberships, and roles.
   2. Computers and Devices: Locating computers, servers, and other networked devices.
   3. Permissions and Policies: Understanding access control lists (ACLs) and group policies. 
4. Tools: Attackers often use tools like BloodHound and PowerView to automate data collection and visualize the data. These tools help mapping the network, showing relationships between users, groups, and computers.
5. Planning Further Attacks: With the gathered information, attackers can plan their next steps, such as lateral movement, privilege escalation, or targeting specific high-value assets.
6. Exploitation: Using the insights gained, attackers can exploit vulnerabilities, escalate privileges, and move laterally within the network to achieve their objectives, such as data exfiltration or deploying malware.

Detecting LDAP reconnaissance attacks:

Windows logs may be used to detect LDAP reconnaissance, but the logging should be enabled. Here’s a step-by-step guide to help with the process:

1. Enable Detailed Logging:
   1. Audit Directory Service Access: Ensure that auditing for directory service access is enabled.
   2. Enable LDAP Logging: Modify the registry to enable detailed LDAP logging. 
2. Identify Suspicious LDAP Queries:
   1. Event ID 4662: Monitor for Event ID 4662, which indicates an operation was performed on an object in Active Directory. Pay attention to Write Property, Control Access, DELETE, WRITE_DAC and WRITE_OWNER access types.
   2. Event ID 1644: This Event ID logs expensive or inefficient LDAP queries. 
3. Analyse Query Patterns:
   1. Unusual Search Filters: Look for unusual search filters in the logs. Attackers often use specific filters to enumerate users, groups, and computers.
   2. High Volume of Queries: Identify spikes in the volume of LDAP queries, which can indicate reconnaissance activity. 
4. Use Advanced Hunting Queries:
   1. Utilize advanced hunting queries within any deployed EDR/XDR solution. 
5. Investigate and Respond:
   1. Correlate Events: Correlate LDAP query events with other suspicious activities, such as failed login attempts or unusual network traffic.
   2. Isolate and Remediate: If you identify suspicious activity, isolate the affected systems and accounts, conduct a thorough investigation and take appropriate remediation steps. 

The Windows Event ID 1644 may be used to investigate these attacks. Look for queries that return large datasets or are executed frequently. Pay attention to operations involving sensitive attributes like admincount, user, computer, or person.

The script Event1644Reader.ps1 is available from Microsoft. This script extracts data from these events and imports them into Excel pivot tables for easier analysis. This can help provide insight into the LDAP workloads as well as identifying which clients and queries are generating the heaviest load.

Correlate these events with Event ID 4662 and other events, such as failed logins or unusual network traffic, to build a complete picture of potential reconnaissance activities.

Event ID 4662 example:

This attack is mapped as T1087.002 on Mitre ATT&CK. Discovery (T1087) Account Discovery: Domain Account (002) https://attack.mitre.org/techniques/T1087/002/.

Preventing LDAP attacks:

It is possible to prevent these attacks by adopting different strategies to enhance security:

1. Enforce LDAP Signing: This prevents attackers from intercepting and modifying LDAP traffic. You can enforce this setting through Group Policy by setting the “Domain Controller: LDAP server signing requirements” to “Require signing”.
2. Use Secure LDAP (LDAPS): Configure LDAP over SSL/TLS (LDAPS) to encrypt the traffic protecting against eavesdropping and man-in-the-middle attacks.
3. Input validation and sanitization: Validate and sanitize all user inputs to prevent LDAP injection attacks. Use parameterized queries and escape special characters.
4. Limit Privileges: Apply the principle of least privilege by restricting LDAP account permissions to the minimum necessary reducing the impact of a potential attack.
5. Monitor: Regularly audit and monitor LDAP logs for unusual activity. Use tools such as Security Information and Event Management (SIEM) to detect and respond to suspicious behavior.
6. Patch and Update Systems: Keep your systems and software up to date with the latest security patches to mitigate vulnerabilities.

Conclusion:

LDAP reconnaissance is used by threat actors to gather information about an Active Directory environment. This attack is employed to gather information to escalate privileges or move laterally between systems. 

To mitigate these attacks, it is possible to enforce LDAP signing and use secure LDAP. Limiting privileges will reduce the impact of a compromise.

However, since preventive measures can sometimes fail, it is vital to enhance detection and response capabilities to swiftly address such incidents.

Learn more about the following services to help you proactively prepare against Active Directory attacks:

• Security Engineering and Active Directory Review
• Incident Readiness
• Digital Identity Protection

Signup to our free Threat Intelligence for regular updates on the latest threat actors or contact NCC Group if you have any further queries.