The (!FALSE) Pattern | Huntress

What it is

Part 4 of Huntress's LDAP/ADWS detection series, analyzing how SOAPHound (by FalconForce) evades Event ID 1644 signature detection. SOAPHound hardcodes the LDAP filter (!soaphound=*) across its collection modes, querying a non-existent attribute. The post shows why the tool's name never reaches the logs — and what markers survive that you can hunt on instead.

How it works

Active Directory deviates from RFC 4511 (which says filters on unrecognized attributes evaluate to Undefined, returning nothing). Per Microsoft's AD Technical Specification, the DC's LDAP service instead evaluates a non-existent attribute to FALSE, then optimizes the negation server-side during query parsing — after schema validation, before writing to Event ID 1644. The result: (!soaphound=*) is logged as ( ! (FALSE) ) and returns every object in the domain (311 of 311 in the lab). This is universal AD behavior; any negated non-existent attribute produces the identical filter and full-object return.

Because SOAPHound uses ADWS (port 9389, SOAP/XML) rather than direct LDAP, the DC proxies the query locally — so Event 1644 shows a localhost/link-local client ([::1] or fe80::…), obscuring attribution.

What to do

The signature (!soaphound=*) is useless — it never appears. Hunt on what remains in Event ID 1644:

• Filter ( ! (FALSE) ) — an unusual pattern most defenders have never baselined.
• Combined with Server controls: SDFlags:0x7 and a localhost/link-local Client field, this distinguishes real SOAPHound from a benign [all]-attributes, [none]-controls test query.
• The specific attribute selection SOAPHound requests (a strong secondary signal): name, sAMAccountName, cn, dNSHostName, objectSid, objectGUID, primaryGroupID, distinguishedName, lastLogonTimestamp, pwdLastSet, servicePrincipalName, nTSecurityDescriptor, userAccountControl, sIDHistory, member, adminCount, msDS-AllowedToDelegateTo, gPCFileSysPath, gPLink, and others.

Reproduce the transformation in a lab (Part 1's Event 1644 logging enabled):

$searcher = [adsisearcher]"(!soaphound=*)"
$searcher.PageSize = 1000 # Ensure we get all results
$results = $searcher.FindAll()
Write-Host "Query: (!soaphound=*)"
Write-Host "Results: $($results.Count) objects"

Caveats

The ( ! (FALSE) ) pattern is not unique to SOAPHound — any tool or query negating a non-existent attribute triggers it, so the filter alone will false-positive. The distinguishing combination is filter + SDFlags:0x7 + localhost client + the attribute list. The post excerpt cuts off mid-sentence on the SDFlags point (referencing Part 3), so treat the SDFlags detail as continued from that earlier post.