alert tcp any any -> $HOME_NET 389 (msg:"🐾 - 🔔 Anonymous LDAP bind request - 🥷 Domain Account Discovery - T1087.002"; flow:to_server, established; flowbits:set,pptrls.ldapanonymousbindrequest; flowbits:isnotset,pptrls.ldapanonymousbindrequest; content:"|30 0c 02 01|"; startswith; content:"|60 07 02 01 03 04 00 80 00|"; fast_pattern; distance:1; endswith; reference:url,https://attack.mitre.org/techniques/T1087/002/; reference:url,https://ldap3.readthedocs.io/en/latest/bind.html#anonymous-bind; metadata:created_at 2024_08_29, updated_at 2024_08_29, signature_severity Major, attack_target Server_Endpoint, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mitre_technique_id T1087_002, mitre_technique_name Account_Discovery_Domain_Account; sid:3321363; rev:5; classtype:attempted-recon;)