LoFP / false positives should be limited as the destination port is specific to active directory web services protocol, however we recommend utilizing this analytic to hunt for non-standard processes querying the adws port. filter by app or dest_ip to ad servers and remove known proceses querying adws.

Techniques

• T1069
• T1069.001
• T1069.002
• T1087
• T1087.001
• T1087.002
• T1482

Sample rules

Network Traffic to Active Directory Web Services Protocol

• source: splunk
• technicques:
  • T1087.002
  • T1069.001
  • T1482
  • T1087.001
  • T1087
  • T1069.002
  • T1069

Description

The following analytic identifies network traffic directed to the Active Directory Web Services Protocol (ADWS) on port 9389. It leverages network traffic logs, focusing on source and destination IP addresses, application names, and destination ports. This activity is significant as ADWS is used to manage Active Directory, and unauthorized access could indicate malicious intent. If confirmed malicious, an attacker could manipulate Active Directory, potentially leading to privilege escalation, unauthorized access, or persistent control over the environment.

Detection logic

| tstats count from datamodel=Network_Traffic where All_Traffic.dest_port=9389 by All_Traffic.src_ip, All_Traffic.dest_ip, All_Traffic.app, All_Traffic.user, All_Traffic.dest_port 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `drop_dm_object_name("All_Traffic")` 
| `network_traffic_to_active_directory_web_services_protocol_filter`