{"id":"b3ad3c0f-c949-47a1-a30e-b0491ccae876","title":"Uncommon Connection to Active Directory Web Services","description":"Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated with ADWS management.\n","author":"@kostastsale","status":"test","level":"medium","date":"2024-01-26","modified":"","tags":["attack.discovery","attack.t1087"],"technique_ids":["T1087"],"logsource":{"category":"network_connection","product":"windows"},"falsepositives":["ADWS is used by a number of legitimate applications that need to interact with Active Directory. These applications should be added to the allow-listing to avoid false positives."],"references":["https://medium.com/falconforce/soaphound-tool-to-collect-active-directory-data-via-adws-165aca78288c","https://github.com/FalconForceTeam/FalconFriday/blob/a9219dfcfd89836f34660223f47d766982bdce46/Discovery/ADWS_Connection_from_Unexpected_Binary-Win.md"],"source_path":"rules/windows/network_connection/net_connection_win_adws_unusual_connection.yml","source_sha256":"4ae565602de74786604f83f1a0a44872e5c99bd9785fb0ae1c105f9a84cd4f37","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/network_connection/net_connection_win_adws_unusual_connection.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Uncommon Connection to Active Directory Web Services\nid: b3ad3c0f-c949-47a1-a30e-b0491ccae876\nstatus: test\ndescription: |\n    Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated with ADWS management.\nreferences:\n    - https://medium.com/falconforce/soaphound-tool-to-collect-active-directory-data-via-adws-165aca78288c\n    - https://github.com/FalconForceTeam/FalconFriday/blob/a9219dfcfd89836f34660223f47d766982bdce46/Discovery/ADWS_Connection_from_Unexpected_Binary-Win.md\nauthor: '@kostastsale'\ndate: 2024-01-26\ntags:\n    - attack.discovery\n    - attack.t1087\nlogsource:\n    category: network_connection\n    product: windows\ndetection:\n    selection:\n        Initiated: true\n        DestinationPort: 9389\n    filter_main_dsac:\n        Image: 'C:\\Windows\\system32\\dsac.exe'\n    filter_main_ms_monitoring_agent:\n        Image: 'C:\\Program Files\\Microsoft Monitoring Agent\\'\n    filter_main_powershell:\n        Image|startswith:\n            - 'C:\\Program Files\\PowerShell\\7\\pwsh.exe'\n            - 'C:\\Program Files\\PowerShell\\7-preview\\pwsh.ex'\n            - 'C:\\Windows\\System32\\WindowsPowerShell\\'\n            - 'C:\\Windows\\SysWOW64\\WindowsPowerShell\\'\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - ADWS is used by a number of legitimate applications that need to interact with Active Directory. These applications should be added to the allow-listing to avoid false positives.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1087","id":"T1087","name":"Account Discovery","page":"techniques/enterprise/T1087/"}],"data_path":"data/detection-rules/b3ad3c0f-c949-47a1-a30e-b0491ccae876.json","kind":"sigma"}