Skip to content

Active Directory Web Services

Named by 3 kept items in this workspace.

Search every workspace for Active Directory Web Services. It matches the name as written, so it can find other things that share it.

The items that name it 3

  • The 60ms Window: How Event 5156 Solves the ADWS Attribution Problem
    writeup2026-04-09It is written here as Active Directory Web Services (ADWS).

    Listens on port 9389; used for AD enumeration/collection; hides attacker source IP by translating requests to loopback LDAP calls

  • The ADWS Architecture That Hides PowerShell AD Enumeration
    writeup2026-04-08It is written here as Active Directory Web Services (ADWS).

    Runs on port 9389 with TLS-encrypted SOAP/XML; used by PowerShell to query Active Directory, invisible to traditional LDAP network detection

  • The (!FALSE) Pattern | Huntress
    writeup2026-01-29It is written here as Active Directory Web Services (ADWS).

    Port 9389, SOAP/XML protocol used by SOAPHound; proxies LDAP queries locally causing Event 1644 to show Client: [::1] (localhost), complicating attribution

All technologies in this workspace.