SharpADWS AD Reconnaissance via ADWS Port 9389
Detects execution of the SharpADWS reconnaissance tool or suspicious outbound network connections to Active Directory Web Services (ADWS) port 9389. This activity is used by threat actors, such as Mustang Panda, to perform Active Directory reconnaissance by bypassing standard LDAP logging.
YARA-L
