{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,7]],"date-time":"2026-08-07T16:40:29Z","timestamp":1786120829038,"version":"build-2736575974"},"publisher-location":"New York, NY, USA","reference-count":33,"publisher":"ACM","license":[{"start":{"date-parts":[[2026,8,8]],"date-time":"2026-08-08T00:00:00Z","timestamp":1786147200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by-nc-nd\/4.0\/legalcode"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2026,8,9]]},"DOI":"10.1145\/3770855.3818449","type":"proceedings-article","created":{"date-parts":[[2026,8,7]],"date-time":"2026-08-07T01:08:33Z","timestamp":1786064913000},"page":"7197-7208","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["ML-Powered LDAP Reconnaissance Detection using Weak Supervision"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0005-6710-8408","authenticated-orcid":false,"given":"Shaefer","family":"Drew","sequence":"first","affiliation":[{"name":"CrowdStrike, Redmond, OR, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9900-1972","authenticated-orcid":false,"given":"Edward","family":"Raff","sequence":"additional","affiliation":[{"name":"CrowdStrike, Jamesville, NY, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-7776-4698","authenticated-orcid":false,"given":"Michael","family":"Brautbar","sequence":"additional","affiliation":[{"name":"CrowdStrike, Groton, MA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-7889-7661","authenticated-orcid":false,"given":"Yaron","family":"Zinar","sequence":"additional","affiliation":[{"name":"CrowdStrike, Petah Tikva, Israel"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2720-7963","authenticated-orcid":false,"given":"Benjamin","family":"Malmberg","sequence":"additional","affiliation":[{"name":"CrowdStrike, Utrecht, Netherlands"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-8133-586X","authenticated-orcid":false,"given":"Dor","family":"Agron","sequence":"additional","affiliation":[{"name":"CrowdStrike, Zurich, Switzerland"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-1688-1975","authenticated-orcid":false,"given":"Sagi","family":"Sheinfeld","sequence":"additional","affiliation":[{"name":"CrowdStrike, Tel-Aviv, Israel"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-7357-0796","authenticated-orcid":false,"given":"Avraham","family":"Kama","sequence":"additional","affiliation":[{"name":"CrowdStrike, Beer Yaakov, Israel"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-0045-0517","authenticated-orcid":false,"given":"Asaf","family":"Romano","sequence":"additional","affiliation":[{"name":"CrowdStrike, Giv'atayim, Israel"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,8,8]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"Dirk-jan. 2018a. BloodHound.py. https:\/\/github.com\/dirkjanm\/BloodHound.py Accessed 2026-02-05."},{"key":"e_1_3_2_1_2_1","unstructured":"FalconForce. 2024. SOAPHound. https:\/\/github.com\/FalconForceTeam\/SOAPHound Accessed 2026-02-05."},{"key":"e_1_3_2_1_3_1","unstructured":"GhostPack. 2018b. Rubeus. https:\/\/github.com\/GhostPack\/Rubeus Accessed 2026-02-05."},{"key":"e_1_3_2_1_4_1","unstructured":"SpecterOps. 2021. SharpHound. https:\/\/github.com\/SpecterOps\/SharpHound Accessed 2026-02-05."},{"key":"e_1_3_2_1_5_1","unstructured":"SpecterOps. 2023. BloodHound. https:\/\/github.com\/SpecterOps\/BloodHound Accessed 2026-02-05."},{"key":"e_1_3_2_1_6_1","first-page":"106","article-title":"Machine-Learned Suspicious Query Detection","volume":"18","author":"Agron Dor","year":"2025","unstructured":"Dor Agron, Michael Avraham Brautbar, Shaefer Drew, Avraham Kama, Asaf Lavi, Sagi Sheinfeld, and Yaron Zinar. 2025. Machine-Learned Suspicious Query Detection. US Patent App. 18\/630,106.","journal-title":"US Patent App."},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1214\/09-SS054"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1109\/BigData62323.2024.10825710"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1088\/1749-4699\/8\/1\/014008"},{"key":"e_1_3_2_1_10_1","unstructured":"Christian Blichmann. 2008. Automatisierte Signaturgenerierung f\u00fcr Malware-St\u00e4mme. Ph.D. Dissertation. Technical University of Dortmund."},{"key":"e_1_3_2_1_11_1","volume-title":"Teoria statistica delle classi e calcolo delle probabilita. Pubblicazioni del R Istituto Superiore di Scienze Economiche e Commericiali di Firenze","author":"Bonferroni Carlo","year":"1936","unstructured":"Carlo Bonferroni. 1936. Teoria statistica delle classi e calcolo delle probabilita. Pubblicazioni del R Istituto Superiore di Scienze Economiche e Commericiali di Firenze, Vol. 8 (1936), 3-62."},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833796"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/2939672.2939785"},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.4324\/9780203771587"},{"key":"e_1_3_2_1_15_1","unstructured":"Shaefer Drew Mickey Brautbar and Yaron Zinar. 2025. Caught in the Act: CrowdStrike's New ML-Powered LDAP Reconnaissance Detections. CrowdStrike Blog. https:\/\/www.crowdstrike.com\/en-us\/blog\/inside-crowdstrike-ml-powered-ldap-reconnaissance-detections\/ Accessed: 2025-12-01."},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/3459637.3481896"},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1214\/aos\/1013203451"},{"key":"e_1_3_2_1_18_1","first-page":"65","article-title":"A simple sequentially rejective multiple test procedure","volume":"6","author":"Holm Sture","year":"1979","unstructured":"Sture Holm. 1979. A simple sequentially rejective multiple test procedure. Scandinavian Journal of Statistics, Vol. 6, 2 (1979), 65-70.","journal-title":"Scandinavian Journal of Statistics"},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1109\/NCA53618.2021.9685959"},{"key":"e_1_3_2_1_20_1","volume-title":"Proceedings of the 13th conference on USENIX Security Symposium -","volume":"13","author":"Kim Hyang-Ah","year":"2004","unstructured":"Hyang-Ah Kim and Brad Karp. 2004. Autograph: toward automated, distributed worm signature detection. In Proceedings of the 13th conference on USENIX Security Symposium - Volume 13. 19. hrefhttps:\/\/doi.org\/10.1.1.94.5342doi:10.1.1.94.5342,"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3616625"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2005.15"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.5555\/1953048.2078195"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/3297067.3297080"},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/3411508.3421372"},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-41284-4_8"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.14778\/3157794.3157797"},{"key":"e_1_3_2_1_28_1","unstructured":"Team Snorkel. 2022. Weak Supervision Modeling with Fred Sala. https:\/\/snorkel.ai\/blog\/weak-supervision-modeling\/"},{"key":"e_1_3_2_1_29_1","volume-title":"NDSS","author":"Venkataraman Shobha","unstructured":"Shobha Venkataraman, Avrim Blum, and Dawn Song. 2008. Limits of Learning-based Signature Generation with Adversaries. In NDSS. http:\/\/repository.cmu.edu\/ece"},{"key":"e_1_3_2_1_30_1","volume-title":"Resampling-based multiple testing: Examples and methods for p-value adjustment","author":"Westfall Peter H","unstructured":"Peter H Westfall and S Stanley Young. 1993. Resampling-based multiple testing: Examples and methods for p-value adjustment. John Wiley & Sons."},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1080\/01621459.1927.10502953"},{"key":"e_1_3_2_1_32_1","volume-title":"Proceedings of the 14th Conference on USENIX Security Symposium -","volume":"14","author":"Yegneswaran Vinod","year":"2005","unstructured":"Vinod Yegneswaran, Jonathon T Giffin, Paul Barford, and Somesh Jha. 2005. An Architecture for Generating Semantics-aware Signatures. In Proceedings of the 14th Conference on USENIX Security Symposium - Volume 14. USENIX Association, Berkeley, CA, USA, 7. http:\/\/dl.acm.org\/citation.cfm?id=1251398.1251405 Series Title: SSYM'05."},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1109\/DSN64029.2025.00072"}],"event":{"name":"KDD '26: The 32nd ACM SIGKDD Conference on Knowledge Discovery and Data Mining","location":"Jeju Island Republic of Korea","sponsor":["SIGMOD ACM Special Interest Group on Management of Data","SIGKDD ACM Special Interest Group on Knowledge Discovery in Data"]},"container-title":["Proceedings of the 32nd ACM SIGKDD Conference on Knowledge Discovery and Data Mining V.2"],"original-title":[],"deposited":{"date-parts":[[2026,8,7]],"date-time":"2026-08-07T01:28:18Z","timestamp":1786066098000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3770855.3818449"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,8,8]]},"references-count":33,"alternative-id":["10.1145\/3770855.3818449","10.1145\/3770855"],"URL":"https:\/\/doi.org\/10.1145\/3770855.3818449","relation":{},"subject":[],"published":{"date-parts":[[2026,8,8]]},"assertion":[{"value":"2026-08-08","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}