AD enumeration via ADWS (port 9389) appearing as localhost Event 1644
This rule detects potential Active Directory enumeration activity by monitoring ADWS (Active Directory Web Services) port 9389. It captures activity where Microsoft.ActiveDirectory.WebServices.exe is engaged, and correlates this with Windows Event ID 1644, which identifies LDAP queries being executed. The rule specifically looks for local loopback connections often used to proxy and obfuscate the origin of these LDAP queries, helping to identify enumeration patterns that might be intended to hide the source workstation.
Microsoft Sentinel (KQL)
