Windows Workstation | Microsoft Sentinel "Honeytoken Queried via LDAP" False Positive

Partners and their customers may receive security alerts from Microsoft Sentinel (or similar SIEM platforms) flagging high-volume LDAP traffic originating from endpoints where the Liongard Agent is installed.

These alerts typically present as:

This activity is not malicious. The LDAP queries are generated by the Liongard Windows Workstation Inspector as part of its normal domain data collection process.

Screenshots show the Sentinel Incidents dashboard where alerts appear.

​Microsoft Sentinel Overview showing incidents and alerts summary where honeytoken alerts may appear.

​

The Windows Workstation Inspector supports a feature called Domain Extraction that collects domain identity information such as:

When enabled, the inspector performs a broad LDAP query against the Active Directory domain.

Example command:

Because this query enumerates all domain objects, it may also query honeytoken accounts configured in the environment.

Security monitoring tools such as Microsoft Sentinel detect this activity and may flag it as: MITRE ATT&CK: T1087.002 – Domain Account Discovery

⚠️ Sentinel cannot distinguish between authorized IT management tools and malicious reconnaissance, which results in a false positive alert.

Understanding the expected behavior of the Liongard Agent helps determine whether activity is legitimate.

All Liongard Agent communication is outbound only, over HTTPS (port 443), to:

The agent sends periodic heartbeats (every 3 minutes) and inspector results. It does not open inbound ports, communicate peer-to-peer between agents, or make direct network connections to domain controllers. LDAP queries are made locally on the workstation using the Windows LDAP API.

LDAP activity is expected and more frequent on devices that are Microsoft Entra Hybrid Joined (previously Hybrid Azure AD Joined), as these devices have line-of-sight to both on-premises Active Directory and Azure AD. This is consistent behaviour and does not indicate misconfiguration.

The Liongard Agent communicates outbound only over HTTPS.

Required endpoints:

Required port:

Agent behavior includes:

💡 LDAP queries occur locally via the Windows LDAP API, not through direct network communication initiated by the agent.

The recommended resolution is to exclude Liongard processes from the Sentinel analytic rule.

In Microsoft Sentinel:

Edit the rule and add the following filter:

If your query uses a different field:

KQL Query Editor in Sentinel

If a dedicated Liongard service account is used:

⚠️ Important:
Only exclude the service account from this specific analytic rule.

Do not disable monitoring for the account across all Sentinel rules.

If your SOC policy requires that honeytoken accounts must never be queried, Domain Extraction can be disabled.

⚠️ Note: Disabling this feature prevents Liongard from collecting domain user and group information.

If machines were isolated after the alert, the Liongard Agent may appear Offline.

Common errors in agent logs:

3. Restart the Liongard Agent service:

The agent should reconnect within 3 minutes.