DirectoryOps in Defender and EDR

Why Defender reports it

Attackers read an Active Directory before they strike. That is why EDR and ITDR products watch LDAP queries closely:

• Microsoft Defender for Endpoint sees on the admin workstation which process sends which LDAP filter. Filters that look exactly like those of known attack tools lead to alerts such as “Suspicious LDAP query”, whatever the program is called.
• Microsoft Defender for Identity sees the queries on the domain controller and learns what is normal for a device. If a device reads the whole domain for the first time, “Security principal reconnaissance (LDAP)”, for example, may follow. According to Microsoft the learning period is 15 days per computer.
• Other assessment tools with a similar scope, such as PingCastle or Purple Knight, also read extensively and can in practice trigger similar alerts. Such an alert during an announced assessment is therefore nothing unusual.

What DirectoryOps does

In progress

With the next version the risk assessment reads “quietly”: a snapshot of the directory with a few generic, paged LDAP searches (1000 objects per page). DirectoryOps then evaluates all 130 rules locally on your workstation. Targeted filters like the ones attack tools send no longer go over the wire.

Never: bitwise userAccountControl filters, servicePrincipalName=*, adminCount=1, delegation filters, sIDHistory=* or (objectClass=pKICertificateTemplate). No passwords, no LAPS, BitLocker or gMSA secrets, no PowerShell, no SMB or RPC to clients, no Kerberos tickets. LDAP to domain controllers only, signed and sealed.

Before the first assessment per domain, DirectoryOps shows the note for your security team. “Copy text for the SOC” gives you a ready-made message with process, workstation, account and time window.

What may still be reported

Quiet does not mean invisible. Behaviour-based detection may still report the reads, especially:

• Defender for Identity during its learning period, when a workstation reads the whole domain for the first time
• reading security-relevant attributes and permissions, for example of AdminSDHolder, Tier 0 groups and PKI objects
• listing the PKI containers, even without the typical filter

For an announced run your SOC classifies such alerts as “Informational, expected activity” and then tunes narrowly as described below.

Defender XDR: alert tuning

Alert tuning (formerly “alert suppression”) is the recommended way for alerts from Defender for Endpoint and for Defender for Identity alerts in the Defender format.

1. In the Microsoft Defender portal open Settings > Microsoft Defender XDR > Alert tuning and select Add new rule. Alternatively select Tune alert on the alert itself and limit the rule to this alert type.
2. Under Select service sources choose Microsoft Defender for Endpoint and Microsoft Defender for Identity.
3. Under Conditions combine with AND: file or process DirectoryOps.exe, publisher TOMORIS GmbH (for an unsigned pre-release the SHA-256 hash) and the admin workstation. For Defender for Identity alerts, which have no process: source device and account.
4. Under Action choose Resolve alert. Hide alert exists only for Defender for Endpoint and hides more than necessary.
5. Enter a meaningful name and a comment with your ticket number and select Save.

Microsoft describes the procedure under Tune an alert. The exact name of the publisher condition in the editor may differ depending on the portal version.

Defender for Identity

Microsoft recommends alert tuning here as well. Exclusions only apply to alerts in the classic format; once a detection has moved to Defender XDR they no longer apply. If you still need them:

1. Open System > Settings > Identities > Excluded entities, then Exclusions by detection rule.
2. Select the detection, for example Security principal reconnaissance (LDAP), then Excluded entities and Exclude devices.
3. Add the admin workstation, not the account. An excluded account would be invisible on every device. Do not use Global excluded entities.

Source: Detection exclusions in Microsoft Defender XDR.

Defender for Endpoint: indicators

An “Allow” indicator is only needed if Defender blocks DirectoryOps. It does not help against LDAP alerts: according to Microsoft, Allow affects antivirus and automated investigation, not behavioural alerts.

• Settings > Endpoints > Indicators, then Add indicator. For the TOMORIS certificate use the indicator type Certificates (.cer or .pem file, leaf certificate only).
• Set an expiration date and limit the scope to the device group of the admin workstations. Remove it once Microsoft has resolved a false detection.
• Requirement: Microsoft Defender Antivirus in active mode with cloud protection. Changes can take up to three hours.

Sources: Create indicators based on certificates, Overview of indicators.

Other EDR products

The same applies to CrowdStrike Falcon, SentinelOne and others. Feature names differ per vendor; please check them in the respective console.

• Preferred: suppression or exclusion for the specific detection, scoped to the process DirectoryOps.exe, the publisher TOMORIS GmbH or the SHA-256, and the host group of the admin workstations.
• Avoid: exclusions that switch off sensor visibility, path-only exclusions and exclusions from malware detection.
• ITDR on the domain controller: tune the source device, not the account.

Publisher or hash

Release packages are digitally signed by TOMORIS GmbH and timestamped. Check the Valid status and the publisher. Rules work best with this publisher; it stays the same across updates. For an older unsigned lab build, use the file's SHA-256 hash together with the workstation. Every new version has a new hash.

Get-FileHash 'C:\Program Files\TOMORIS\DirectoryOps\DirectoryOps.exe' -Algorithm SHA256
Get-AuthenticodeSignature 'C:\Program Files\TOMORIS\DirectoryOps\DirectoryOps.exe' |
  Select Status, SignerCertificate

Text for the SOC

The app fills in this text with real values (Copy text for the SOC). As a template to adapt:

German

Betreff: Angekündigte Verzeichnisabfragen durch DirectoryOps (Risikobewertung, nur lesend)

Hallo,

wir führen mit DirectoryOps eine Risikobewertung unseres Active Directory durch. Die Bewertung liest nur;
Microsoft Defender for Endpoint bzw. Defender for Identity kann die Verzeichnisabfragen dennoch als
Aufklärung melden (z. B. „Suspicious LDAP query“). Bitte ordnen Sie Meldungen mit den folgenden Merkmalen
als erwartete Aktivität ein.

Prozess:            DirectoryOps.exe
Herausgeber:        TOMORIS GmbH (bei einer unsignierten Vorabversion SHA-256: <SHA-256>)
Installationspfad:  C:\Program Files\TOMORIS\DirectoryOps\DirectoryOps.exe
Admin-Arbeitsplatz: <COMPUTERNAME>
Konto:              <DOMÄNE\Konto>
Domäne / DC:        <domäne> / <domain-controller>
Zeitfenster:        <von> bis <bis> (<Zeitzone>)
Ansprechpartner:    <Name, Telefon, E-Mail>

Was DirectoryOps tut: Es liest nur, mit generischen, seitenweisen LDAP-Suchen, und wertet die Regeln lokal
auf dem Admin-Arbeitsplatz aus. Keine Kennwörter, keine LAPS-, BitLocker- oder gMSA-Geheimnisse, keine
PowerShell, kein SMB/RPC zu Clients, keine Kerberos-Tickets. LDAP mit Signierung und Verschlüsselung, nur zu
Domain Controllern.

Eine dauerhafte Regel bitte eng fassen: Prozess mit Signatur bzw. Hash, dieser Arbeitsplatz, dieses Konto.
Anleitung für SOC-Teams: https://directoryops.tomoris.com/hilfe/defender/

English

Subject: Announced directory reads by DirectoryOps (risk assessment, read-only)

Hello,

we are running a risk assessment of our Active Directory with DirectoryOps. The assessment is read-only;
Microsoft Defender for Endpoint or Defender for Identity may still report the directory reads as
reconnaissance (e.g. "Suspicious LDAP query"). Please treat alerts matching the details below as
expected activity.

Process:            DirectoryOps.exe
Publisher:          TOMORIS GmbH (for an unsigned pre-release SHA-256: <SHA-256>)
Install path:       C:\Program Files\TOMORIS\DirectoryOps\DirectoryOps.exe
Admin workstation:  <COMPUTERNAME>
Account:            <DOMAIN\account>
Domain / DC:        <domain> / <domain controller>
Time window:        <from> to <to> (<time zone>)
Contact:            <name, phone, e-mail>

What DirectoryOps does: it is read-only, uses generic paged LDAP searches and evaluates the rules locally
on the admin workstation. No passwords, no LAPS, BitLocker or gMSA secrets, no PowerShell, no SMB/RPC to
clients, no Kerberos tickets. LDAP with signing and sealing, to domain controllers only.

Please scope any permanent rule narrowly: process with signature or hash, this workstation, this account.
Guide for SOC teams: https://directoryops.tomoris.com/hilfe/defender/

We are happy to answer your SOC's questions: contact@tomoris.com.