I would use the groupType attribute to define distribution lists. Here you can find information to find out the difference between security / distribution.
And the filter might look like this:
(&(objectClass=group)(!(groupType:1.2.840.113556.1.4.803:=2147483648)))
EDIT
alternatively, you can check groups that have email addresses, smth like:
(&(objectClass=group)(proxyAddresses=*))
source
share