LDAP Ping is a pre-credential Active Directory reconnaissance technique that abuses the anonymous DC Locator protocol to enumerate valid usernames without generating authentication failures. The tool ldapnomnom claims to produce no Windows audit logs, but source code analysis confirms it uses TCP exclusively, making connections visible to Event 5156 (Windows Filtering Platform). Event 1644 is structurally blind to LDAP Ping because the query is dispatched to netlogon.dll, bypassing the LDAP search engine. netlogon.log captures every query and response including disabled-account state invisible to the attacker. True UDP cLDAP remains a blind spot for Windows event logging, requiring network-layer visibility or MDI for attribution.
LDAP Ping
1 post
From Code to Coverage (Part 6): What netlogon.log Sees That Event 1644 Never Will