The 60ms Window: How Event 5156 Solves the ADWS Attribution Problem

What it is

A detection-engineering walkthrough (Huntress, "Part 5B") showing how to attribute Active Directory Web Services (ADWS) enumeration — e.g. via SOAPy — back to a real originating host, despite ADWS proxying queries to LDAP over loopback so the Directory Service log shows only [::1]. It directly rebuts a claim made in the BloodHound Slack #red-team channel that 5156-based correlation, while "theoretically" possible, is impractical.

How it works

Three events are chained across a tight timing window:

• Event 5156 (Windows Filtering Platform / Security log) — fires on the inbound connection to ADWS port 9389, recording the real source IP and the owning process microsoft.activedirectory.webservices.exe (not a generic svchost.exe). This happens before ADWS rewrites the request to a loopback LDAP call.
• Event 1138 (AD Web Services log) — logs the new connection with the client's real IP plus a unique InstanceId tying the session to later activity.
• Event 1644 (Directory Service log) — the internal LDAP query, now showing [::1]:<ephemeral port> (page example: [::1]:60983), with user context and query details preserved but source IP gone.

Attribution comes from matching the ephemeral port in the 1644 loopback client against an internal 5156 for the ADWS→LDAP connection, then pivoting to the external 5156 to recover the source IP.

flowchart LR
  A[Remote host → :9389<br/>Event 5156: real IP] --> B[Event 1138<br/>real IP + InstanceId]
  B --> C[ADWS rewrites to<br/>loopback LDAP]
  C --> D[Event 1644<br/>client = ::1:ephemeral]
  D -. match ephemeral port .-> C

Preconditions / Affected

• Event 5156 is on by default under the Filtering Platform Connection audit subcategory — no extra config needed. The post notes it is "already being collected by most enterprise SIEMs."
• Correlation depends on all three events being retained and on the timing window holding.

What to do

• Ensure 5156 is retained rather than tuned out for volume, and correlate on ephemeral port + timestamp.
• To cut false positives (all of RSAT uses ADWS, so sysadmins trip port-9389 rules), the author advises pattern-matching on the 1644 query itself rather than the network event — flagging enumeration signatures such as [all_with_list], SDflags:0x7, and (!(FALSE)).

Caveats

• The counterparty's concerns are real and only partly answered: 5156 is high-volume, and large identity products (e.g. MDI) reportedly don't alert on it for collection due to normal-traffic noise — so this supports triage/attribution more than turnkey alerting.
• The fetched text cuts off mid-"Phase 2," so the full correlation query and the stated 60ms window figure are not shown in the excerpt.