Full Report
ldapnomnom claims it leaves no Windows audit logs. This post shows why Event 1644 misses LDAP Ping and where defenders can still catch it.
Analysis Summary
# Tool/Technique: ldapnomnom / LDAP Ping Enumeration
## Overview
**ldapnomnom** is a reconnaissance tool designed to anonymously and rapidly brute-force Active Directory usernames by abusing **LDAP Ping** requests (cLDAP). The tool is intended to be used during the pre-credential phase of an attack to identify valid users without triggering standard Windows authentication logs. While the tool claims to be "invisible," technical analysis reveals specific logging artifacts in `netlogon.log` and the Windows Filtering Platform (WFP).
## Technical Details
- **Type:** Attack Tool / Enumeration Technique
- **Platform:** Windows Active Directory (Target); Cross-platform Go-based tool (Attacker)
- **Capabilities:**
- Anonymous username enumeration (unauthenticated).
- High-speed brute-forcing.
- Identification of valid vs. invalid AD accounts.
- **First Seen:** Tool released circa 2023-2024; LDAP Ping technique is a legacy protocol feature.
## MITRE ATT&CK Mapping
- **[TA0007 - Discovery]**
- **[T1087.002 - Account Discovery: Domain Account]**
- **[T1069.002 - Permission Groups Discovery: Domain Groups]**
- **[TA0001 - Reconnaissance]**
- **[T1595 - Active Scanning]**
## Functionality
### Core Capabilities
- **LDAP Ping Abuse:** Utilizes specifically crafted LDAP search filters (e.g., `(&(DnsDomain=ad.local)(User=username))`) to query Domain Controllers.
- **RootDSE Queries:** Exploits the fact that DCs respond to certain RootDSE attributes without requiring a "Bind" (authentication).
- **Netlogon Integration:** Unlike standard LDAP queries, LDAP Pings are handled by `netlogon.dll` rather than the core LDAP engine (`ntdsa.dll`), bypassing many security monitors.
### Advanced Features
- **TCP Fallback:** By default, the tool often communicates over TCP port 389. While cLDAP is traditionally UDP, the Go library used by `ldapnomnom` defaults to TCP, which creates a more trackable connection state.
- **High Concurrency:** Designed for speed, allowing for the rapid testing of large wordlists against a DC.
## Indicators of Compromise
- **File Names:** `ldapnomnom`, `ldapnomnom.exe`
- **Network Indicators:**
- Traffic to Domain Controllers on port **389** (TCP/UDP) without a subsequent `LDAP BIND` request.
- Source IPs originating from non-standard or unauthorized workstations performing high-frequency queries to the DC.
- **Behavioral Indicators:**
- A sudden spike in "LDAP Ping" traffic handled by the Netlogon service.
- Large volumes of username lookup requests appearing in Netlogon logs from a single source.
## Associated Threat Actors
- Generally used by **Red Teams** and **Penetration Testers** for initial discovery.
- Applicable to any threat actor performing internal reconnaissance post-network entry but pre-credential theft.
## Detection Methods
- **Log Correlation:**
- **Netlogon Logging:** Enable `nltest /dbflag:0x2080ffff`. The `netlogon.log` (found in `%windir%\debug\`) will record every attempted username lookup, even if unauthenticated.
- **Windows Event 5156:** For the TCP-based version of the tool, WFP logs (Event 5156) can capture the source IP address connecting to the LSASS process.
- **Structural Blind Spot:** **Event 1644** (LDAP search logging) is **blind** to this technique because the traffic bypasses the LDAP processing engine.
- **MDI (Microsoft Defender for Identity):** Can detect these probes but often relies on specific volume thresholds.
## Mitigation Strategies
- **Network Segmentation:** Restrict access to Domain Controllers on port 389/636 to only known, authorized subnets.
- **EDR/Monitoring:** Deploy sensors capable of monitoring the `netlogon.log` file for anomalies or massive volumes of `SamLogon` / `Search` entries.
- **Intrusion Detection Systems (IDS):** Use signatures to detect high-frequency UDP/TCP 389 traffic that lacks standard LDAP session establishment.
## Related Tools/Techniques
- **cLDAP (Connectionless LDAP):** The underlying protocol used for DC discovery.
- **ADFind:** A common tool for AD enumeration that can perform similar queries.
- **SOAPHound / BloodHound:** Authenticated enumeration tools that represent the "next step" after `ldapnomnom` identifies valid targets.