Full Report
SOAPHound's LDAP query (!soaphound=*) never appears in Event 1644 logs, but it transforms into (! (FALSE)) through LDAP optimization. Understanding this transformation reveals a unique detection signature that most defenders have never seen.
Analysis Summary
# Tool/Technique: SOAPHound / LDAP Optimization Evasion
## Overview
SOAPHound is a custom Active Directory (AD) enumeration tool designed to perform reconnaissance while evading traditional LDAP monitoring. It achieves this by using Active Directory Web Services (ADWS) instead of direct LDAP, and by employing a specific query transformation technique that exploits how Domain Controllers optimize unrecognized attributes.
## Technical Details
- **Type:** Attack Tool / Reconnaissance
- **Platform:** Windows (Active Directory environments)
- **Capabilities:** AD enumeration, permission discovery, stealthy LDAP querying via ADWS proxying.
- **First Seen:** January 2026 (Article Publication)
## MITRE ATT&CK Mapping
- **TA0007 - Discovery**
- **T1087.002 - Account Discovery: Domain Account**
- **T1018 - Remote System Discovery**
- **T1069.002 - Permission Groups Discovery: Domain Groups**
- **TA0005 - Defense Evasion**
- **T1562 - Impair Defenses (Log Evasion)**
## Functionality
### Core Capabilities
- **ADWS Communication:** Uses port 9389 (SOAP/XML) to communicate with Active Directory. This causes Domain Controllers to log the source of the LDAP query as `::1` (localhost), masking the true origin of the attacker.
- **Full Domain Enumeration:** Capable of returning all objects in a domain by using generalized filters.
### Advanced Features
- **Filter Optimization Evasion:** Uses the hardcoded LDAP filter `(!soaphound=*)`. Because "soaphound" is a non-existent attribute, the Windows LDAP engine optimizes this query to `(! (FALSE))` during processing.
- **Signature Obfuscation:** The tool's literal string (`soaphound`) never appears in Event ID 1644 logs, rendering string-based detections for the tool name ineffective.
## Indicators of Compromise
- **File Names:** `SOAPHound.exe` (Default name from GitHub source).
- **Network Indicators:** Traffic on port `9389/TCP` (Active Directory Web Services) from non-standard administrative hosts.
- **Behavioral Indicators:**
- High volume of LDAP queries appearing to originate from `Client: [::1]` or `127.0.0.1` in Event ID 1644.
- Presence of the specific optimized filter string `( ! (FALSE) )` in LDAP logs.
- Queries returning a disproportionately high number of entries (e.g., thousands of visited entries for a single search).
## Associated Threat Actors
- While no specific APT groups are currently linked in the text, the tool is publicly available on GitHub (FalconForceTeam) and is designed for use by red teams and sophisticated threat actors.
## Detection Methods
- **Behavioral Detection:** Monitor Windows **Event ID 1644** (Directory Service Access) for the specific filter string `( ! (FALSE) )`.
- **Proxy Attribution:** Investigate any Event 1644 logs where the client address is the loopback address (`::1`), as this indicates a proxy (like ADWS) is being used to hide the source.
- **Volume Analysis:** Alert on LDAP searches that result in a high number of "Visited entries" combined with the `(! (FALSE))` pattern, indicating bulk data collection.
## Mitigation Strategies
- **Hardening:** Disable Active Directory Web Services (ADWS) on Domain Controllers if not required for management tools like Active Directory Administrative Center (ADAC).
- **Segmentation:** Restrict access to port 9389 to known, authorized management workstations.
- **Monitoring:** Ensure "Field Engineering" logging is enabled on Domain Controllers to capture Event ID 1644, which provides the visibility needed to see the transformed filters.
## Related Tools/Techniques
- **Impacket (LDAP search):** Uses OID-based bitwise filters (Part 1).
- **BloodHound:** Traditional LDAP-based AD enumeration.
- **SDFlags:** A technique to modify how LDAP queries are processed to evade detection (Part 3).