Common signs include repeated LDAP enumeration from a non administrative workstation, searches for servicePrincipalName values, broad queries against organizational units named for services, and requests focused on accounts with password never expires enabled. If those patterns appear together, treat them as reconnaissance, not normal administration, and investigate the source host, account context, and timing.
How reconnaissance looks before the account is touched
service account discovery usually starts as low-noise enumeration rather than direct abuse. In Active Directory, an operator often begins by asking the directory what exists, how it is named, and which accounts look operationally important. That means the early signal is often broad read activity from an unexpected source, not a failed logon or obvious privilege escalation.
The strongest clue is pattern, not any single query. Repeated LDAP enumeration from a non-administrative workstation, especially when it is paired with servicePrincipalName lookups and OU browsing, suggests someone is mapping where service account live and how they are named. When the same source also asks for accounts with password never expires enabled, the activity is usually moving from discovery into targeting.
Which directory queries are most suspicious
Discovery activity tends to focus on attributes that reveal reach, persistence, and likely privilege. ServicePrincipalName searches are important because they expose candidate service accounts and often point to systems that support authentication paths or delegation relationships. Queries against service-focused OUs can be equally revealing because they show the actor is not browsing casually, but filtering toward operational identities.
Requests for accounts with non-expiring passwords are especially meaningful because they often identify long-lived credentials that are easier to reuse or cache. A benign admin task might touch one of these data points, but a real discovery sequence usually combines them, repeats them, and does so from a host that does not normally perform directory administration. That combination is what raises confidence.
How to separate normal administration from hostile enumeration
Normal administration usually follows expected job function, source host, and timing. It is often performed by known admin workstations, through standard management tooling, and in a pattern that aligns with maintenance windows or troubleshooting. Reconnaissance looks different because it is exploratory, cross-cutting, and often comes from a user context that has no reason to collect a service-account inventory.
The practical distinction is whether the queries are bounded by a task or are building an access map. If the activity touches many directories, many naming patterns, and many accounts in a short period, it is more consistent with discovery than operations. If the same host later attempts Kerberos ticket abuse, lateral movement, or credential testing, the earlier LDAP activity should be treated as the setup phase of the incident.
Risk and Threat Considerations
Service account discovery matters because it can expose the easiest paths to durable access, especially where service accounts are overprivileged, long-lived, or poorly monitored. Once an attacker can identify which accounts exist and which ones are likely to run critical services, the next step is often credential theft, ticket abuse, or lateral movement using a trusted directory path.
Failure mechanism: Directory enumeration reveals account names, service bindings, and persistence indicators, which lets an attacker select high-value targets and avoid noisy trial-and-error activity.
Impact: Compromise of one service account can create broad access, hidden persistence, and access to additional systems that trust that identity.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1087 — Account Discovery | LDAP enumeration and account listing are direct account discovery behaviors. |
| T1212 — Exploitation for Credential Access | Discovery of service accounts often precedes credential targeting and reuse. | |
| Recommendation — Map directory enumeration to account discovery and hunt for follow-on access activity. Correlate discovery activity with credential-access attempts and prioritize exposed service accounts. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitoring for anomalous activity | Unexpected LDAP querying from a non-admin workstation is an anomalous monitoring signal. |
| Recommendation — Baseline directory-query behavior and alert on abnormal enumeration from untrusted hosts. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | Directory discovery is best validated through review and analysis of directory audit evidence. |
| Recommendation — Review LDAP and directory audit logs for repeated enumeration patterns and related source context. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Detection depends on preserving and analyzing directory and endpoint logs for enumeration patterns. |
| Recommendation — Centralize and retain directory logs so repeated service-account discovery can be investigated quickly. | ||
Practitioner Guidance
What to verify: Check whether the source host is a known admin endpoint, whether the querying account normally performs directory discovery, and whether the timing matches approved administration. A single suspicious query is less important than a repeatable sequence that combines servicePrincipalName lookups, OU sweeps, and password-never-expires filtering.
What good looks like: You should be able to explain why the query happened, who initiated it, and what operational ticket or change justified it. If you cannot tie the activity to a routine directory management task, treat it as a hunting lead and preserve the query source, account context, and downstream access attempts.
Practitioner takeaway: Service account discovery is usually visible first as structured reconnaissance, so the response should prioritize source validation and blast-radius assessment before assuming the activity is harmless inventory work.
Related resources from NHI Mgmt Group
- How should teams respond when a service account token is exposed?
- What are the signs that an Active Directory account is being used with stolen credentials?
- What are the signs that Active Directory computer account management is becoming unreliable?
- What are the signs that SPN-jacking may be happening in an Active Directory environment?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 26, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
