SharpADWS AD Reconnaissance via ADWS Port 9389 Bypassing LDAP Logging

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

Detects execution of the SharpADWS utility or anomalous network connections to the Active Directory Web Services port (9389) that are not initiated by legitimate processes such as lsass.exe, svchost.exe, or the legitimate Microsoft.ActiveDirectory.WebServices.exe binary.