Full Report
ldapnomnom claims it leaves no Windows audit logs. This post shows why Event 1644 misses LDAP Ping and where defenders can still catch it.
Analysis Summary
# Tool/Technique: ldapnomnom / LDAP Ping Enumeration
## Overview
**ldapnomnom** is a reconnaissance tool designed to anonymously and rapidly brute-force Active Directory usernames by abusing **LDAP Ping** requests (cLDAP). Unlike traditional LDAP queries that require authentication (Bind), LDAP Ping allows unauthenticated discovery of whether a username exists within a domain. The tool’s primary appeal is its claim of being "invisible" to standard Windows Event logging.
## Technical Details
- **Type:** Attack Tool / Reconnaissance
- **Platform:** Windows Active Directory environments (targets Domain Controllers)
- **Capabilities:** Anonymous username enumeration, high-speed brute-forcing, support for both TCP and UDP transports.
- **First Seen:** Publicly documented/refined via GitHub (referenced in Huntress research June 2024).
## MITRE ATT&CK Mapping
- **[TA0007 - Discovery]**
- **[T1087.002 - Account Discovery: Domain Account]**
- **[T1069.002 - Permission Groups Discovery: Domain Groups]**
- **[TA0009 - Collection]**
- **[T1213 - Data from Information Repositories]**
## Functionality
### Core Capabilities
- **Anonymous Enumeration:** Exploits the RootDSE to send LDAP search requests for specific usernames without providing credentials.
- **LDAP Ping (cLDAP) Abuse:** Uses a specific code path in Windows (handled by `netlogon.dll` rather than the standard LDAP engine `ntdsa.dll`) to verify account existence.
- **Speed:** Capable of testing thousands of usernames per second.
### Advanced Features
- **TCP Fallback/Default:** While cLDAP is traditionally UDP-based, the `ldapnomnom` tool defaults to TCP in many configurations, which inadvertently increases its forensic footprint.
- **Bypassing Event 1644:** Because the requests are handled by the Netlogon service and not the LDAP engine, they do not trigger Field Engineering log "Event 1644" (Expensive/Inefficient LDAP Searches).
## Indicators of Compromise
- **File Names:** `ldapnomnom`, `ldapnomnom.exe`
- **Network Indicators:**
- Traffic to Domain Controllers on Port **389** (LDAP) or **389/UDP** (cLDAP) from unauthenticated sources.
- Large volumes of LDAP SearchRequests with filters targeting `sAMAccountName`.
- **Behavioral Indicators:**
- **Netlogon Logging:** High volume of entries in `%systemroot%\debug\netlogon.log` featuring search requests for various usernames.
- **Windows Filtering Platform:** Event ID **5156** showing repeated connections to port 389 from a single source IP, even if no logon event occurs.
## Associated Threat Actors
- Used by various red teams and initial access brokers for pre-credential reconnaissance.
## Detection Methods
- **Behavioral Detection:**
- Monitor **Event ID 5156** (Connection Allowed) on Domain Controllers. Look for a single source IP making a high frequency of connections to port 389 without corresponding **Event ID 4624** (Successful Logon).
- Enable and parse **Netlogon logging** (requires `nltest /dbflag:0x2080ffff`). This log records the actual usernames being probed, even when Windows Event Logs remain silent.
- **MDI (Microsoft Defender for Identity):** Can detect LDAP Ping enumeration through specialized sensors that monitor raw network traffic, though it may rely on specific volume thresholds.
- **Network-Based Detection:** Use NDR or firewall logs to identify unusual UDP/389 (cLDAP) traffic, as this is structurally "blind" to most Windows host-based logging except for Netlogon debug logs.
## Mitigation Strategies
- **Network Segmentation:** Limit which workstations or segments can communicate with Domain Controllers via LDAP (Port 389).
- **Monitoring:** Implement centralized log collection for `netlogon.log` across all Domain Controllers.
- **Honeytokens:** Deploy "decoy" accounts in Active Directory; if `ldapnomnom` probes these accounts, it serves as a high-fidelity alert of enumeration.
## Related Tools/Techniques
- **cLDAP:** The underlying protocol (Connectionless LDAP).
- **ADWS Enumeration:** Using Active Directory Web Services (Port 9389) for similar discovery (see SOAPHound).
- **BloodHound / ADFind:** Tools used for post-authentication enumeration that are often detected by the Event 1644 logs that `ldapnomnom` avoids.