Uncommon Connection to Active Directory Web Services

Hunt Hypothesis

Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated with ADWS management.

Detection Rule

Sigma (Original)

title: Uncommon Connection to Active Directory Web Services
id: b3ad3c0f-c949-47a1-a30e-b0491ccae876
status: test
description: |
    Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated with ADWS management.
references:
    - https://medium.com/falconforce/soaphound-tool-to-collect-active-directory-data-via-adws-165aca78288c
    - https://github.com/FalconForceTeam/FalconFriday/blob/a9219dfcfd89836f34660223f47d766982bdce46/Discovery/ADWS_Connection_from_Unexpected_Binary-Win.md
author: '@kostastsale'
date: 2024-01-26
tags:
    - attack.discovery
    - attack.t1087
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Initiated: true
        DestinationPort: 9389
    filter_main_dsac:
        Image: 'C:\Windows\system32\dsac.exe'
    filter_main_ms_monitoring_agent:
        Image: 'C:\Program Files\Microsoft Monitoring Agent\'
    filter_main_powershell:
        Image|startswith:
            - 'C:\Program Files\PowerShell\7\pwsh.exe'
            - 'C:\Program Files\PowerShell\7-preview\pwsh.ex'
            - 'C:\Windows\System32\WindowsPowerShell\'
            - 'C:\Windows\SysWOW64\WindowsPowerShell\'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - ADWS is used by a number of legitimate applications that need to interact with Active Directory. These applications should be added to the allow-listing to avoid false positives.
level: medium

KQL (Azure Sentinel)

imNetworkSession
| where (NetworkDirection =~ true and DstPortNumber == 9389) and (not(((SrcProcessName =~ "C:\\Windows\\system32\\dsac.exe" or DstProcessName =~ "C:\\Windows\\system32\\dsac.exe") or (SrcProcessName =~ "C:\\Program Files\\Microsoft Monitoring Agent\\" or DstProcessName =~ "C:\\Program Files\\Microsoft Monitoring Agent\\") or ((SrcProcessName startswith "C:\\Program Files\\PowerShell\\7\\pwsh.exe" or SrcProcessName startswith "C:\\Program Files\\PowerShell\\7-preview\\pwsh.ex" or SrcProcessName startswith "C:\\Windows\\System32\\WindowsPowerShell\\" or SrcProcessName startswith "C:\\Windows\\SysWOW64\\WindowsPowerShell\\") or (DstProcessName startswith "C:\\Program Files\\PowerShell\\7\\pwsh.exe" or DstProcessName startswith "C:\\Program Files\\PowerShell\\7-preview\\pwsh.ex" or DstProcessName startswith "C:\\Windows\\System32\\WindowsPowerShell\\" or DstProcessName startswith "C:\\Windows\\SysWOW64\\WindowsPowerShell\\")))))

Required Data Sources

False Positive Guidance

• ADWS is used by a number of legitimate applications that need to interact with Active Directory. These applications should be added to the allow-listing to avoid false positives.

MITRE ATT&CK Context

• Tactic: Discovery
• Technique: T1087 — T1087

References

• https://medium.com/falconforce/soaphound-tool-to-collect-active-directory-data-via-adws-165aca78288c
• https://github.com/FalconForceTeam/FalconFriday/blob/a9219dfcfd89836f34660223f47d766982bdce46/Discovery/ADWS_Connection_from_Unexpected_Binary-Win.md
• SigmaHQ Rule