SharpADWS AD Reconnaissance via ADWS Named Pipe and Port 9389

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•7

Detects reconnaissance and enumeration activities targeting Active Directory Web Services (ADWS) on port 9389. This includes specific detection of the SharpADWS tool and anomalous processes that connect to ADWS, a technique used to bypass standard LDAP monitoring by encapsulating AD queries within SOAP messages.