SharpADWS AD Reconnaissance via ADWS Port 9389 Bypassing LDAP Logging
Detects potential abuse of Active Directory Web Services (ADWS) by identifying the execution of known tools like SharpADWS or suspicious network connections to ADWS port 9389 by non-standard processes. The rule monitors Sysmon process creation and network connection events for keywords related to Active Directory web enumeration.
Splunk (SPL)
