Active Directory Web Services: Unusual Network Connection Detection
This brief provides a detection mechanism to identify unauthorized or anomalous processes attempting to connect to Active Directory Web Services (ADWS) on port 9389, a technique potentially used for reconnaissance or data collection.
Triage facts
Revision 1- Applicability
- Windows
- Evidence
- Unknown
- Severity
- Medium
- Action
- Monitor or close
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 5, 12:58 UTC
- Detection
- 1 rule
- Source quality
- B2Likely
Active Directory Web Services (ADWS) provides a web service interface to Active Directory instances. Adversaries can abuse this interface to query directory information without directly interacting with the LDAP service, often to evade traditional LDAP monitoring. This detection targets processes that initiate network connections to the ADWS default port (9389) that are not recognized as standard management utilities or known PowerShell binaries.
Recommendation
- Deploy the provided Sigma rule to your SIEM to baseline and monitor outbound connections to port 9389 from domain-joined workstations and servers.
- Establish an allow-list of legitimate administrative tools or custom applications within your environment that are verified to interact with ADWS.
- Audit active connections to port 9389 to identify non-standard binaries performing directory discovery.
Threat Hunt
Identify all processes connecting to port 9389 in the environment to establish a baseline of authorized software.
Data: Network connection logs (EDR or Netflow)
Detection coverage 1
Detect Uncommon Connection to Active Directory Web Services
mediumDetects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated with ADWS management.
Detection queries are available on the platform. Get full rules →