ML Detects LDAP Reconnaissance Using Weak Supervision

This research introduces two machine learning frameworks designed to enhance the detection of Lightweight Directory Access Protocol (LDAP) reconnaissance activities. LDAP is a common target for threat actors seeking to map Active Directory data after an initial compromise. The goal is to identify these malicious queries early in the attack chain. The first framework employs a weakly supervised ML classifier to predict malicious LDAP queries. It correlates LDAP queries with endpoint detections to automatically label a massive dataset, overcoming the cost and time constraints of manual labeling. The second framework builds upon this by using a statistical hypothesis-testing method to mine novel, malicious LDAP signatures for immediate deployment. Despite the limitations of weak supervision compared to manual labeling, this automated approach proved practical and effective. The classifier achieved a 65% True Positive Rate with controlled false positives, while the mined signatures showed 81.48% field precision in real-world testing.