The ADWS Architecture That Hides PowerShell AD Enumeration

What it is

Part 5A of Huntress's LDAP/AD detection series, covering a real intrusion where a threat actor enumerated an entire Active Directory environment with a single native PowerShell command and evaded all four prior detection stages in the series. The command:

geT-aDcompUTER -Filter {eNaBLed -eq $TruE} -PROPErTieS *

How it works

PowerShell's AD cmdlets do not open an LDAP connection to 389/636. They speak SOAP/XML over TLS to Active Directory Web Services (ADWS) on port 9389. ADWS then issues the LDAP query to the DC on behalf of the session, but does so as localhost — so Event 1644 records Client: [::1]:port with the valid domain user, not the attacker's IP. The ADWS translation layer also normalizes the query: case obfuscation and PowerShell filter syntax are gone by the time it hits the DC, leaving clean LDAP ({eNaBLed -eq $TruE} → !(userAccountControl&2)). The case mixing (geT-aDcompUTER) evaded endpoint/string-matching EDR but was, per the author, a red herring — the query would have been invisible to network- and 1644-based detection even typed normally.

The recovery path: the original client IP is preserved in the ADWS connection events (1138/1139), which must be correlated with the 1644 LDAP event to attribute the query.

Preconditions / Affected

• Affects anyone relying on network LDAP sensors (389/636) or on Event 1644 alone — both are blind to ADWS enumeration.
• Event 1644 is not emitted by default: the author had to enable field engineering logging on the domain controllers to capture it at all.

What to do

• Enable field engineering logging on DCs so Event 1644 is produced.
• Do not detect on Event 1644 in isolation — its client field shows localhost. Correlate 1644 with the ADWS events 1138/1139 (which hold the real client IP) and 1166/1167.
• Monitor/capture port 9389 (the author used a span port with Wireshark) rather than only 389/636.

Caveats

This is Part 5A and the fetched text is the problem-framing half — it establishes the blind spot and the correlation strategy but the excerpt cuts off before delivering finished Sigma rules or exact query logic. All findings come from the author's MARVEL.LOCAL lab plus one real incident, not a broad study.