DEF CON 32 - MaLDAPtive: Obfuscation and De-Obfuscation - Daniel Bohannon, Sabajete Elezaj

BLUF: The video reveals a comprehensive analysis of LDAP obfuscation techniques, demonstrating how attackers can evade detection through complex filtering, and presents a defensive solution—Maladaptive—that enables defenders to detect and respond to these obfuscated queries with precision and speed.

Key Takeaways:
• LDAP filters can be obfuscated using casing, object identifiers, ambiguous name resolution, and wildcards, all of which are documented or undocumented and effective in evading detection 12:01–13:51.
• Comparison operators like range, approximate equality, and bitwise logic can be manipulated to create false positives or bypass simple string-based detections, especially in Active Directory environments 15:00–17:40.
• Boolean operators (AND, OR, NOT) can be layered or inverted to create complex, logically equivalent filters—such as using De Morgan’s Law—making detection extremely challenging without advanced parsing 18:00–20:40.
• Extensible Match Filters allow bitwise value manipulation (e.g., breaking down 515 into 1, 2, and 512), enabling attackers to generate diverse, valid filters that evade signature-based detection 21:40–23:30.
• Attribute values and base objects can also be obfuscated via hex encoding, prepended zeros, and whitespace, with client-side logs showing raw syntax while server logs normalize results—requiring careful parsing to avoid misinterpretation 24:00–29:50.
• Maladaptive provides a parser, enrichment engine, and detection rules (65 total) to analyze LDAP queries in real time, with support for both interactive and CLI tools, and is designed to help defenders detect obfuscated activi