🧰 SOAPHound

The items that name it 4

• From Code to Coverage (Part 6): What netlogon.log Sees That Event 1644 Never Will
  writeup2026-06-24

  Authenticated AD enumeration tool referenced as part of the detection series

• The ADWS Architecture That Hides PowerShell AD Enumeration
  writeup2026-04-08

  Referenced from Part 4 of the series; tool whose queries transform and can be detected via the (!FALSE) pattern

• The (!FALSE) Pattern | Huntress
  writeup2026-01-29

  AD enumeration tool by FalconForce; uses ADWS instead of raw LDAP; hardcodes the query (!soaphound=*) which gets logged as (! (FALSE)); consistently uses SDFlags:0x7 server control across LDAP-based modes (buildcache, bhdump, certdump)

• SDFlags | Huntress
  article2026-01-15

  Attack path/AD enumeration tool referenced via FalconForce blog post explaining SACL permission issues with nTSecurityDescriptor queries