ADWS Connections from Unknown Devices

Robbe Van den Daele@RobbeVdDaele

•updated Aug 19, 2025•2•0•67

This hunting rule searches for incoming ADWS connections on Domain Controllers from IP Addresses that cannot be linked to Microsoft Defender for Endpoint (MDE) onboarded devices. It aims to detect enumeration activities using ADWS from unmanaged or unknown devices, which might bypass typical monitoring tools.