Full Report
Event 1644 shows localhost, hiding the attacker's real IP. By correlating Event 5156 with a ~60-80ms timing window, you can attribute ADWS queries to their actual source—and the data was already in your SIEM.
Analysis Summary
# Tool/Technique: Event 5156 Correlation for ADWS Attribution
## Overview
This technique addresses a significant "blind spot" in Active Directory monitoring: Active Directory Web Services (ADWS). When attackers use tools to query ADWS (port 9389), the resulting LDAP logs (Event 1644) falsely show the source IP as `127.0.0.1` (localhost) because the ADWS service acts as a local proxy to the LDAP engine. This technique uses Windows Filtering Platform (WFP) connection events to correlate the external attacker's IP with the internal loopback LDAP query.
## Technical Details
- **Type**: Technique (Log Correlation / Attribution)
- **Platform**: Windows Server (Domain Controllers)
- **Capabilities**: Bypasses the anonymity provided by the ADWS loopback proxy; enables source IP attribution for SOAP-based AD enumeration.
- **First Seen**: Research published April 2026 (based on article date).
## MITRE ATT&CK Mapping
- **TA0007 - Discovery**
- **T1087.002 - Account Discovery: Domain Account**
- **T1069.002 - Permission Groups Discovery: Domain Groups**
- **T1484.002 - Domain Policy Modification: Domain Trust Discovery**
- **TA0009 - Collection**
- **T1005 - Data from Local System** (via ADWS proxy)
## Functionality
### Core Capabilities
- **De-anonymization**: Links an incoming connection on port 9389 (ADWS) to a near-simultaneous LDAP query (Event 1644) originating from `127.0.0.1`.
- **Timing Window Correlation**: Utilizes a specific temporal window (~60-80ms) to match network events to service-level diagnostic logs.
### Advanced Features
- **Cross-Protocol Attribution**: Connects SOAP/XML traffic (ADWS) to underlying LDAP operations, which are typically logged separately without source headers.
## Indicators of Compromise
- **File Names**: `Microsoft.ActiveDirectory.WebServices.exe` (Process associated with the activity).
- **Network Indicators**:
- Incoming traffic to port `9389` (ADWS) from unauthorized or non-admin workstations.
- Unusual LDAP queries originating from `127.0.0.1` in Event 1644 logs.
- **Behavioral Indicators**:
- High volume of Event **5156** (Windows Filtering Platform) involving `9389` followed immediately by Event **1644**.
- Use of specific tools like **SOAPY** or **BloodHound** (ADWS collection mode).
## Associated Threat Actors
- General Red Team practitioners and advanced threat actors seeking to bypass traditional LDAP monitoring (SACLs/1644 logs) by leveraging the ADWS management protocol.
## Detection Methods
- **Behavioral Detection**:
- Enable **Audit Filtering Platform Connection** (Success).
- Correlate **Event ID 5156** (Inbound to port 9389) with **Event ID 1644** (Internal LDAP search) where the `CorrelationID` or `Timestamp` aligns within <100ms.
- **SIEM Logic**: Filter for Event 1644 where `Client IP: 127.0.0.1` and join on the most recent Event 5156 directed at the ADWS process.
## Mitigation Strategies
- **Hardening**:
- Restrict access to port `9389` via host-based or network firewalls to only authorized Jump Boxes or Admin workstations.
- Disable the **Active Directory Web Services (ADWS)** service on Domain Controllers if not required for management tools like Active Directory Administrative Center (ADAC).
- **Monitoring**: Ensure `Field Engineering` registry keys are set to log expensive/inefficient LDAP queries (Event 1644).
## Related Tools/Techniques
- **SOAPY**: A tool for interacting with ADWS for enumeration.
- **BloodHound**: Can be configured to use ADWS for stealthier data collection.
- **RSAT (Remote Server Administration Tools)**: The legitimate suite that uses ADWS, often creating "noise" that attackers hide within.