Active Directory Web Services Connection Followed by LDAP Activity

Steven Lim@KQLWizard

•updated Feb 18, 2026•11•1•197

This rule detects inbound network connections to Active Directory Web Services (ADWS) on port 9389, followed by either LDAP query events (Event ID 1644) or operations on Active Directory objects (Event ID 4662) originating from the same device. This combination of events can indicate reconnaissance or malicious activity targeting Active Directory, such as attempts to enumerate accounts or groups, or to modify AD objects.