Sigma rule: Uncommon Connection to Active Directory Web Services

Rule

Title

Uncommon Connection to Active Directory Web Services

Status

test

Level

medium

Author

@kostastsale

Date

2024-01-26

File

rules/windows/network_connection/net_connection_win_adws_unusual_connection.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated with ADWS management.

Log source

product

windows

category

network_connection

Detection

selection:
    Initiated: true
    DestinationPort: 9389
filter_main_dsac:
    Image: 'C:\Windows\system32\dsac.exe'
filter_main_ms_monitoring_agent:
    Image: 'C:\Program Files\Microsoft Monitoring Agent\'
filter_main_powershell:
    Image|startswith:
        - 'C:\Program Files\PowerShell\7\pwsh.exe'
        - 'C:\Program Files\PowerShell\7-preview\pwsh.ex'
        - 'C:\Windows\System32\WindowsPowerShell\'
        - 'C:\Windows\SysWOW64\WindowsPowerShell\'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• ADWS is used by a number of legitimate applications that need to interact with Active Directory. These applications should be added to the allow-listing to avoid false positives.

Tags

• attack.discovery
• attack.t1087

MITRE ATT&CK ids this rule names

• T1087

References

• https://medium.com/falconforce/soaphound-tool-to-collect-active-directory-data-via-adws-165aca78288c
• https://github.com/FalconForceTeam/FalconFriday/blob/a9219dfcfd89836f34660223f47d766982bdce46/Discovery/ADWS_Connection_from_Unexpected_Binary-Win.md

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/network_connection/net_connection_win_adws_unusual_connection.yml