The Gentlemen SharpADWS AD Enumeration and Network Scanning

Ibrahim Saud@tektrix

•updated Jun 30, 2026•4•0•4

This rule detects activities associated with domain enumeration and discovery. It monitors for the execution of known offensive tools like SharpADWS, network scanners, and specific PowerShell/command-line operations that query Active Directory groups and computers. Additionally, it identifies unauthorized network connections to the Active Directory Web Services (ADWS) port 9389, which can indicate an attacker attempting to interact with the domain environment directly from a compromised host.