Full Report
A threat actor enumerated our entire AD with Get-ADComputer, and none of our detections fired. The problem wasn't their evasion - it was an architectural blind spot in how PowerShell talks to Active Directory.
Analysis Summary
# Tool/Technique: Active Directory Web Services (ADWS) Enumeration
## Overview
This technique involves using native PowerShell Active Directory cmdlets to perform environment reconnaissance. Unlike traditional tools that communicate via LDAP (ports 389/636), these cmdlets utilize **Active Directory Web Services (ADWS)**. This creates a significant architectural blind spot because ADWS acts as a proxy, making remote malicious queries appear as legitimate local traffic on the Domain Controller.
## Technical Details
- **Type:** Technique / Administrative Tool Abuse
- **Platform:** Windows (Active Directory environments)
- **Capabilities:** Full enumeration of AD objects (computers, users, groups), retrieval of security descriptors (nTSecurityDescriptor), and Service Principal Name (SPN) discovery.
- **First Seen:** ADWS was introduced with Windows Server 2008 R2; this specific bypass awareness is documented as of April 2026 (per article date).
## MITRE ATT&CK Mapping
- **TA0007 - Discovery**
- **T1018 - Remote System Discovery**
- **T1087.002 - Account Discovery: Domain Account**
- **T1069.002 - Permission Groups Discovery: Domain Groups**
- **TA0005 - Defense Evasion**
- **T1027 - Obfuscated Files or Information** (via PowerShell case-shuffling)
- **T1562 - Impair Defenses** (Abusing architectural proxies to bypass LDAP monitoring)
## Functionality
### Core Capabilities
- **SOAP/XML Communication:** Uses the Active Directory Web Service protocol over TCP port 9389.
- **Native Execution:** Uses `Get-ADComputer`, `Get-ADUser`, etc., which are often trusted signed binaries/scripts.
- **Encrypted Transport:** Traffic is wrapped in TLS, preventing network-based IDS/IPS from inspecting LDAP filters.
### Advanced Features
- **Localhost Proxying:** When PowerShell cmdlets query ADWS, the service performs the LDAP lookup locally. Windows Event 1644 (LDAP search) logs the "Client" as `127.0.0.1` or `::1`, effectively stripping the attacker's source IP from primary LDAP logs.
- **Case Obfuscation:** Attackers use randomized casing (e.g., `geT-aDcompUTER`) to bypass simple string-matching detections in PowerShell command-line logging.
## Indicators of Compromise
- **File Names:** `Microsoft.ActiveDirectory.Management.dll` (loaded by PowerShell).
- **Network Indicators:** Traffic directed to port `9389` (defanged: `9389[.]tcp`) from non-admin workstations.
- **Behavioral Indicators:**
- Event ID 1644 on Domain Controllers where the `Client` field is `::1` or `127.0.0.1` but the `User` field is a standard user account.
- Large volumes of LDAP searches originating from the `ADWS` process.
## Associated Threat Actors
- Used by various general threat actors and red teams for "living-off-the-land" (LotL) reconnaissance.
## Detection Methods
- **Behavioral Detection:** Monitor **Active Directory Web Services events (IDs 1138 and 1139)**. These events specifically map the original caller’s IP address to the ADWS request, unlike the resulting LDAP logs.
- **PowerShell Logging:** Enable Script Block Logging (Event ID 4104) to capture de-obfuscated commands, even if case-shuffling is used.
- **Sigma/Log Correlation:** Correlate Event 1644 (LDAP Search) with Event 1138/1139 to identify the true source of "localhost" queries.
## Mitigation Strategies
- **Least Privilege:** Restrict the ability of standard users to read sensitive AD attributes (like `nTSecurityDescriptor` or mass enumeration of computer objects).
- **Network Segmentation:** Block port 9389 at the network level for all hosts except authorized administrative jump boxes.
- **Service Disabling:** If the Active Directory Module for PowerShell is not required on general workstations, ensure it is not installed.
## Related Tools/Techniques
- **[SOAPHound](https://www.huntress.com/blog/ldap-active-directory-detection-part-four):** A tool designed to mimic ADWS traffic to evade LDAP-based detections.
- **BloodHound:** Often uses similar enumeration logic, though usually via direct LDAP.
- **Impacket:** Uses traditional LDAP (analyzed in Part 1 of the series) which is more easily caught by standard OID-based detections.