Network Traffic to Active Directory Web Services Protocol

name: Network Traffic to Active Directory Web Services Protocol
id: 68a0056c-34cb-455f-b03d-df935ea62c4f
version: 10
date: '2026-02-25'
author: Michael Haag, Splunk
status: production
type: Hunting
data_source:
    - Sysmon EventID 3
description: The following analytic identifies network traffic directed to the Active Directory Web Services Protocol (ADWS) on port 9389. It leverages network traffic logs, focusing on source and destination IP addresses, application names, and destination ports. This activity is significant as ADWS is used to manage Active Directory, and unauthorized access could indicate malicious intent. If confirmed malicious, an attacker could manipulate Active Directory, potentially leading to privilege escalation, unauthorized access, or persistent control over the environment.
search: |-
    | tstats count FROM datamodel=Network_Traffic
      WHERE All_Traffic.dest_port=9389
      BY All_Traffic.action All_Traffic.app All_Traffic.dest
         All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction
         All_Traffic.dvc All_Traffic.protocol All_Traffic.protocol_version
         All_Traffic.src All_Traffic.src_ip All_Traffic.src_port
         All_Traffic.transport All_Traffic.user All_Traffic.vendor_product
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `drop_dm_object_name("All_Traffic")`
    | `network_traffic_to_active_directory_web_services_protocol_filter`
how_to_implement: The detection is based on data that originates from network traffic logs. The logs must contain the source and destination IP addresses, the application name, and the destination port. The logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the network traffic data source. The logs must also be mapped to the `Network_Traffic` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives should be limited as the destination port is specific to Active Directory Web Services Protocol, however we recommend utilizing this analytic to hunt for non-standard processes querying the ADWS port. Filter by App or dest_ip to AD servers and remove known processes querying ADWS.
references:
    - https://github.com/FalconForceTeam/SOAPHound
tags:
    analytic_story:
        - Windows Discovery Techniques
    asset_type: Network
    atomic_guid: []
    mitre_attack_id:
        - T1069.001
        - T1069.002
        - T1087.001
        - T1087.002
        - T1482
    product:
        - Splunk Enterprise
        - Splunk Enterprise Security
        - Splunk Cloud
    security_domain: endpoint
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/soaphound/sysmon_soaphound.log
          source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
          sourcetype: XmlWinEventLog