Correlating ADWS Events Can Detect PowerShell Active Directory Enumeration
Summary
Huntress describes how PowerShell AD enumeration over encrypted ADWS can evade network LDAP detection, and explains correlating domain-controller events to reveal queries, requested attributes and security-descriptor enumeration.
Key points
- PowerShell Active Directory cmdlets use encrypted ADWS traffic on port 9389, so network sensors monitoring LDAP on ports 389 or 636 may miss the queries.
- ADWS-generated LDAP Event 1644 can show the domain controller's localhost address rather than the remote client, obscuring the query's origin.
- The article recommends correlating Events 1138, 1139, 1644, 1166 and 1167 by operation ID or instance ID to connect ADWS activity with LDAP query details and results.
- The [all_with_list] attribute-selection prefix can indicate a PowerShell -Properties * bulk property request.
- SDflags:0x7 indicates requests for owner, group and DACL security-descriptor information, which the article identifies as a reconnaissance signal.
- The guidance is based on the author's investigation of an intrusion and lab testing; the article says Part 5B will cover correlating Event 5156 for source-IP attribution.
Article Details
- Defense Focus
- Detect PowerShell-based Active Directory enumeration through ADWS by correlating domain-controller events rather than relying on network LDAP inspection or Event 1644 alone.
- Detection Methods
- Correlate Events 1138, 1139, 1644, 1166, and 1167 by Operation ID or InstanceId within a short time window.
- Treat a localhost LDAP query in Event 1644 as potentially ADWS-mediated activity when it correlates with a remote ADWS connection.
- Look for the [all_with_list] attribute prefix, especially alongside computer or user object queries, as an indicator of PowerShell -Properties * bulk enumeration.
- Inspect Event 1644 server controls for SDflags:0x7, which the article associates with requests for owner, group, and DACL security-descriptor information.
- Use statistical analysis and the correlated session context to distinguish enumeration from ordinary administration; do not rely on query volume or Event 1644 in isolation.
- Data Sources
- Windows Directory Service Event 1644: LDAP filter, attributes, client address, and returned entries.
- ActiveDirectory_WebServices Events 1138 and 1139: ADWS connection and authentication details, including client address, principal, and operation identifiers.
- ADWS Events 1166 and 1167: per-object statistics and session/index information.
- Domain-controller field engineering logging.
- Network telemetry for encrypted SOAP/XML traffic on port 9389; the article notes that this does not expose the LDAP filter or requested attributes.
- Rule Types
- Multi-event Windows event-log correlation rules keyed on Operation ID or InstanceId and a short time window.
- Sigma rules for event-log detection.
- Behavioral and statistical anomaly detection for PowerShell-driven Active Directory enumeration.
- Platforms
- Windows domain controllers
- SIEM
- Defensive Actions
- Enable the required field engineering logging on domain controllers so the relevant ADWS and directory-service events are available.
- Forward and retain Events 1138, 1139, 1166, 1167, and 1644 for correlation.
- Do not discard localhost addresses in Event 1644; correlate them with ADWS connection events to recover the associated client and user context.
- Account for both IPv6 localhost (::1) and IPv4 localhost (127.0.0.1) in detection logic.
- Investigate correlated sessions showing [all_with_list], broad computer or user queries, or SDflags:0x7.
- Keep direct LDAP network and event-based detections in place because the article notes that not all enumeration uses ADWS.