Skip to content

Commit 070c4c5

Browse files
author
AliAtashGar7
committed
Initial commit
1 parent 472bc30 commit 070c4c5

File tree

12 files changed

+411
-1
lines changed

12 files changed

+411
-1
lines changed

‎.github/ISSUE_TEMPLATE/bug_report.md‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
---
2+
name: Bug Report
3+
about: Report an issue with LDAPSentinel
4+
title: "[BUG] - [Title of the bug]"
5+
labels: bug
6+
assignees: ''
7+
8+
---
9+
10+
**Describe the bug**
11+
A clear and concise description of what the bug is.
12+
13+
**Steps to Reproduce**
14+
15+
1. Step one
16+
2. Step two
17+
3. Step three
18+
19+
**Expected behavior**
20+
A clear and concise description of what you expected to happen.
21+
22+
**Screenshots**
23+
If applicable, add screenshots to help explain your problem.
24+
25+
**Environment:**
26+
27+
- OS: [e.g., Ubuntu 20.04]
28+
- Zeek version: [e.g., Zeek 5.1.0]
29+
- LDAPSentinel version: [e.g., 0.1.0]
30+
- Other relevant software versions or configurations
31+
32+
**Additional context**
33+
Add any other context about the problem here.

‎.github/ISSUE_TEMPLATE/feature_request.md‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
name: Feature Request
3+
about: Suggest an idea for LDAPSentinel
4+
title: "[FEATURE REQUEST] - [Title of the feature]"
5+
labels: enhancement
6+
assignees: ''
7+
8+
---
9+
10+
**Is your feature request related to a problem? Please describe.**
11+
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
12+
13+
**Describe the solution you'd like**
14+
A clear and concise description of what you want to happen.
15+
16+
**Describe alternatives you've considered**
17+
A clear and concise description of any alternative solutions or features you've considered.
18+
19+
**Additional context**
20+
Add any other context or screenshots about the feature request here.

‎.github/workflows/ci.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
name: CI for LDAPSentinel
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
pull_request:
8+
branches:
9+
- main
10+
11+
jobs:
12+
build:
13+
runs-on: ubuntu-latest
14+
15+
steps:
16+
# Checkout the code
17+
- name: Checkout repository
18+
uses: actions/checkout@v2
19+
20+
# Set up Zeek environment
21+
- name: Set up Zeek
22+
run: |
23+
sudo apt-get update
24+
sudo apt-get install -y zeek
25+
# You may also install other dependencies like spicy-ldap if necessary
26+
27+
# Run Zeek scripts or tests
28+
- name: Run tests with Zeek
29+
run: |
30+
# Assuming you have some tests in the "tests" directory
31+
zeek -i eth0 scripts/ldap-sentinel.zeek
32+
# Add any additional commands to run your tests
33+
34+
# Optionally, you can upload test results to GitHub if you use a testing framework
35+
- name: Upload test results
36+
uses: actions/upload-artifact@v2
37+
with:
38+
name: test-results
39+
path: path/to/test/results

‎CHANGELOG.md‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# Changelog
2+
3+
All notable changes to this project will be documented in this file.
4+
5+
## [Unreleased]
6+
7+
### Added
8+
9+
- Initial version of LDAPSentinel, a tool for detecting suspicious and malicious LDAP queries.
10+
- Added basic query detection logic to identify reconnaissance and attack patterns in LDAP traffic.
11+
12+
## [0.1.0] - 2025-01-11
13+
14+
### Added
15+
16+
- First official release of LDAPSentinel.
17+
- Implemented core LDAP query analysis using the spicy-ldap package.
18+
- Initial `zkg.meta` and repository structure setup.
19+
20+
### Changed
21+
22+
- N/A
23+
24+
### Fixed
25+
26+
- N/A
27+
28+
### Removed
29+
30+
- N/A

‎CONTRIBUTING.md‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
# Contributing to LDAPSentinel
2+
3+
Thank you for your interest in contributing to **LDAPSentinel**! We welcome contributions of all kinds, including bug reports, feature requests, code contributions, documentation improvements, and more. Your involvement helps make this project better for everyone.
4+
5+
## Code of Conduct
6+
7+
Please note that this project is governed by a [Code of Conduct](https://www.contributor-covenant.org/version/2/1/code_of_conduct/). By participating, you agree to abide by its terms. Be respectful, considerate, and constructive in all interactions.
8+
9+
## How to Contribute
10+
11+
### Reporting Issues
12+
13+
If you encounter any problems or have suggestions for improvement, please create an issue in the [GitHub Issues](https://github.com/your-username/LDAPSentinel/issues) section. Include as much detail as possible:
14+
15+
- Steps to reproduce the issue
16+
- Expected behavior
17+
- Actual behavior
18+
- Any relevant logs or screenshots
19+
20+
### Contributing Code
21+
22+
We welcome code contributions, whether it’s fixing bugs, adding features, or improving existing functionality. To contribute code:
23+
24+
1. **Fork the repository**: Click the "Fork" button on the repository page to create your own copy.
25+
2. **Clone your fork**: Use `git clone` to clone your fork to your local machine.
26+
27+
```bash
28+
git clone https://github.com/your-username/LDAPSentinel.git
29+
```
30+
3. **Create a new branch**: Create a branch for your changes.
31+
32+
```bash
33+
git checkout -b feature-or-bugfix-description
34+
```
35+
4. **Make your changes**: Modify the code or documentation as needed.
36+
5. **Run tests**: Ensure your changes pass all existing tests and add new ones if necessary.
37+
6. **Commit your changes**: Write a clear and descriptive commit message.
38+
39+
```bash
40+
git commit -m "Brief description of your changes"
41+
```
42+
7. **Push your branch**: Push your branch to your forked repository.
43+
44+
```bash
45+
git push origin feature-or-bugfix-description
46+
```
47+
8. **Submit a pull request**: Go to the original repository and create a pull request. Describe your changes in detail and link to any relevant issues.
48+
49+
### Setting Up the Environment
50+
51+
To set up the development environment for **LDAPSentinel**:
52+
53+
1. Ensure you have [Zeek](https://zeek.org) installed (version 6.0 or earlier).
54+
2. Install the [spicy-ldap](https://github.com/zeek/spicy-analyzers) package for parsing LDAP traffic.
55+
3. Clone this repository and navigate to the project directory.
56+
4. Load the `main.zeek` script into your Zeek instance for testing.
57+
58+
### Testing
59+
60+
Tests are located in the `tests/` directory. To run the tests:
61+
62+
1. Use the provided `.pcap` files to simulate LDAP traffic.
63+
2. Run Zeek with the test configuration:
64+
65+
```bash
66+
zeek -r tests/sample_ldap_traffic.pcap scripts/__load__.zeek
67+
```
68+
3. Verify the output matches expected results in the `tests/basic.test` file.
69+
70+
### Submitting Contributions
71+
72+
Before submitting your contributions, ensure the following:
73+
74+
- Your code adheres to the project’s style guidelines.
75+
- Your changes are well-documented.
76+
- All tests pass, and new tests have been added for new functionality.
77+
78+
### Style Guidelines
79+
80+
- Follow Zeek scripting conventions for clarity and maintainability.
81+
- Use meaningful variable and function names.
82+
- Write concise and descriptive comments where necessary.
83+
- Keep commit messages clear and concise.
84+
85+
---
86+
87+
Thank you for contributing to **LDAPSentinel**! Your support and collaboration are greatly appreciated.

‎LICENSE.txt‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2025 Ali AtashGar
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎README.md‎

Lines changed: 96 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,96 @@
1-
# LDAPSentinel
1+
<<<<<<< HEAD
2+
# LDAPSentinel
3+
=======
4+
# LDAPSentinel Repository Structure and README
5+
6+
## Repository Structure
7+
8+
```
9+
LDAPSentinel/
10+
├── .github/
11+
│ ├── ISSUE_TEMPLATE/
12+
│ │ └── bug_report.md
13+
│ └── workflows/
14+
│ └── ci.yml
15+
├── LICENSE
16+
├── README.md
17+
├── CONTRIBUTING.md
18+
├── zkg.meta
19+
├── CHANGELOG.md
20+
├── scripts/
21+
│ ├── __load__.zeek
22+
│ └── main.zeek
23+
├── tests/
24+
│ ├── basic.test
25+
│ └── sample_ldap_traffic.pcap
26+
27+
```
28+
29+
## README
30+
31+
# LDAPDetection - LDAPSentinel
32+
33+
## Overview
34+
35+
LDAPDetection, also known as "LDAPSentinel," is a Zeek script designed to enhance LDAP traffic analysis by identifying potentially suspicious queries. It leverages the spicy-ldap package to parse LDAP traffic for versions of Zeek that do not natively support LDAP.
36+
37+
## Key Features
38+
39+
- Detects LDAP traffic using spicy-ldap for versions of Zeek prior to 6.1.
40+
- Identifies suspicious LDAP queries based on predefined filters.
41+
- Provides detailed logging to aid in security investigations.
42+
43+
## Compatibility
44+
45+
This project is tailored for users running Zeek versions **below 6.1**, as these versions lack built-in support for the LDAP protocol in the `base/protocols/` directory. Starting from Zeek version 6.1, native support for LDAP exists, and this script may require adaptation to integrate seamlessly.
46+
47+
## Installation
48+
49+
1. **Install Dependencies**
50+
51+
- Ensure you have Zeek installed.
52+
53+
- Install spicy-ldap:
54+
55+
```bash
56+
zkg install spicy-ldap
57+
```
58+
59+
2. **Clone Repository**
60+
61+
```bash
62+
git clone https://github.com/yourusername/LDAPSentinel.git
63+
cd LDAPSentinel
64+
```
65+
66+
3. **Load the Script**
67+
Add the following to your `local.zeek` configuration file:
68+
69+
```zeek
70+
@load LDAPDetection
71+
```
72+
73+
4. **Deploy the Configuration**
74+
75+
```bash
76+
zeekctl deploy
77+
```
78+
79+
## Usage
80+
81+
Once deployed, the script will analyze LDAP traffic and identify queries matching the suspicious filter set. Logs will provide details of the source, destination, and detected queries.
82+
83+
For more usage details, refer to the [usage documentation](docs/usage.md).
84+
85+
## Contributing
86+
87+
We welcome contributions! Please see the [CONTRIBUTING.md](CONTRIBUTING.md) file for guidelines on how to contribute to this project.
88+
89+
## License
90+
91+
This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.
92+
93+
## Changelog
94+
95+
All changes to this project are documented in the [CHANGELOG.md](CHANGELOG.md) file.
96+
>>>>>>> 29e751c (Initial commit)

‎scripts/__load__.zeek‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
@load ./main

‎scripts/main.zeek‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
@load spicy-ldap
2+
@load base/frameworks/notice
3+
4+
module LDAPDetection;
5+
6+
export {
7+
redef enum Notice::Type += {
8+
Suspicious_LDAP_Activity
9+
};
10+
11+
const suspicious_filters: set[string] = {
12+
"(groupType:1.2.840.113556.1.4.803:=2147483648)",
13+
"(groupType:1.2.840.113556.1.4.803:=2147483656)",
14+
"(groupType:1.2.840.113556.1.4.803:=2147483652)",
15+
"(groupType:1.2.840.113556.1.4.803:=2147483650)",
16+
"(sAMAccountType=805306369)",
17+
"(sAMAccountType=805306368)",
18+
"(sAMAccountType=536870913)",
19+
"(sAMAccountType=536870912)",
20+
"(sAMAccountType=268435457)",
21+
"(sAMAccountType=268435456)",
22+
"(objectCategory=groupPolicyContainer)",
23+
"(objectCategory=organizationalUnit)",
24+
"(objectCategory=Computer)",
25+
"(objectCategory=nTDSDSA)",
26+
"(objectCategory=server)",
27+
"(objectCategory=domain)",
28+
"(objectCategory=person)",
29+
"(objectCategory=group)",
30+
"(objectCategory=user)",
31+
"(objectClass=trustedDomain)",
32+
"(objectClass=computer)",
33+
"(objectClass=server)",
34+
"(objectClass=group)",
35+
"(objectClass=user)",
36+
"(primaryGroupID=521)",
37+
"(primaryGroupID=516)",
38+
"(primaryGroupID=515)",
39+
"(primaryGroupID=512)",
40+
"Domain Admins",
41+
"objectGUID=*",
42+
"(schemaIDGUID=*)",
43+
"admincount=1"
44+
};
45+
}
46+
47+
event LDAP::log_ldap_search(rec: LDAP::Search) {
48+
for (filter in LDAPDetection::suspicious_filters) {
49+
if (filter in rec$filter) { # Check if filter is a substring of rec$filter
50+
print fmt("Suspicious LDAP query detected: %s, %s", rec$filter, rec$id);
51+
NOTICE([$note=Suspicious_LDAP_Activity, $msg=fmt("Suspicious LDAP query detected: %s", rec$filter), $identifier=rec$filter]);
52+
break;
53+
}
54+
}
55+
}

‎tests/basic.test.log‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
{"ts":1736113502.166532,"note":"LDAPDetection::Suspicious_LDAP_Activity","msg":"Suspicious LDAP query detected: (&(objectCategory=computer)(objectClass=computer))","actions":["Notice::ACTION_LOG"],"email_dest":[],"suppress_for":3600.0}
2+
{"ts":1736113532.512622,"note":"LDAPDetection::Suspicious_LDAP_Activity","msg":"Suspicious LDAP query detected: (&(sAMAccountName=*)(objectCategory=user))","actions":["Notice::ACTION_LOG"],"email_dest":[],"suppress_for":3600.0}
3+
{"ts":1736113554.944964,"note":"LDAPDetection::Suspicious_LDAP_Activity","msg":"Suspicious LDAP query detected: (&(&(objectCategory=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))(servicePrincipalName=*))","actions":["Notice::ACTION_LOG"],"email_dest":[],"suppress_for":3600.0}

0 commit comments

Comments
 (0)