ADWS LDAP search in Advanced Hunting
Analysis / inference: Microsoft Defender for Identity now logs ADWS LDAP search activity inside the IdentityQueryEvents table within Advanced Hunting.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Defender for Identity - What's new · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
Microsoft added ADWS LDAP search activity to the IdentityQueryEvents table in Advanced Hunting and released sensor versions 2.253 and 2.252 with bug fixes and stability improvements.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisThe integration of ADWS LDAP search events into the IdentityQueryEvents table expands SOC threat hunting capabilities and visibility into directory query behavior across enterprise environments.
Enables security operations to track directory queries performed through ADWS and build custom detections using the new event data.
Section 03 · Recommended actions
- Check Advanced Hunting for the presence of ADWS LDAP search data in IdentityQueryEvents.
- Develop custom KQL detection rules targeting ADWS LDAP queries if required by your monitoring posture.
- Ensure Microsoft Defender for Identity sensors are updated to the latest versions.
- Verify if the IdentityQueryEvents table is receiving ADWS LDAP search telemetry in Microsoft Defender Advanced Hunting.
- Review existing custom hunting queries for directory queries to incorporate the new ADWS LDAP search data.