Listen to this Post
Introduction
Active Directory (AD) reconnaissance is a critical phase in both red teaming and penetration testing, but traditional LDAP queries can trigger detection mechanisms. Enter ADWS (Active Directory Web Services), a stealthier alternative that enables fine-grained, incremental data collection while minimizing exposure. In this guide, we explore how SoaPy can be used for covert AD enumeration and how defenders can detect such techniques.
Learning Objectives
- Understand the advantages of ADWS over LDAP for stealthy reconnaissance.
- Learn how to use SoaPy for controlled AD data collection.
- Discover defensive strategies to detect ADWS-based reconnaissance.
1. Why ADWS Beats LDAP for Stealthy Recon
Traditional LDAP queries are noisy and often logged, making them risky for red teams. ADWS, however, uses SOAP (Simple Object Access Protocol) over HTTP/HTTPS, allowing for:
– Smaller, incremental queries (reducing detection risk).
– OPSEC-safe data retrieval (avoiding massive LDAP pulls).
Example: Basic ADWS Query Using PowerShell
Connect to ADWS
$adwsConnection = New-WebServiceProxy -Uri "http://<DC_IP>/ADWS/ActiveDirectoryWebService.asmx" -Namespace "ADWS"
Query for users
$users = $adwsConnection.Enumerate("DC=corp,DC=com", "(objectClass=user)")
$users
What This Does:
- Establishes a low-profile SOAP connection to ADWS.
- Retrieves user objects without triggering LDAP monitoring alerts.
2. Using SoaPy for Controlled AD Enumeration
SoaPy is a Python tool that interacts with ADWS, enabling precise, OPSEC-safe data extraction.
Example: Fetching Domain Admins via SoaPy
from soapy import ADWSClient
client = ADWSClient("dc.corp.com")
query = "(memberOf=CN=Domain Admins,CN=Users,DC=corp,DC=com)"
results = client.query(query, attributes=["sAMAccountName", "lastLogon"])
for user in results:
print(user["sAMAccountName"], user["lastLogon"])
What This Does:
- Queries only Domain Admins, reducing data exposure.
- Retrieves specific attributes (sAMAccountName, lastLogon) for minimal footprint.
3. Defensive Detection: Spotting ADWS Recon
Since ADWS traffic blends with normal web traffic, defenders must look for:
– Unusual SOAP requests to /ADWS/ActiveDirectoryWebService.asmx.
– Small, repeated queries (indicative of incremental recon).
Example: SIEM Rule for ADWS Anomalies (Splunk Query)
index=windows (EventCode=4648 OR EventCode=4769) | where url LIKE "%/ADWS/ActiveDirectoryWebService.asmx%" | stats count by src_ip, user | where count > 10
What This Does:
- Triggers alerts on excessive ADWS SOAP requests.
- Correlates with logon events (EventCode 4648/4769) for context.
4. Bypassing Common Defenses with ADWS
Many EDR solutions focus on LDAP, not ADWS. Attackers can:
– Use SOAP-based tools (SoaPy, BloodHound’s SharpHound with ADWS flag).
– Leverage HTTP proxies to blend in with normal traffic.
Example: BloodHound with ADWS (Stealth Mode)
SharpHound.exe --CollectionMethod Stealth --UseADWS
What This Does:
- Avoids noisy LDAP queries by using ADWS.
- Minimizes event log entries compared to traditional methods.
5. Mitigation: Hardening AD Against ADWS Abuse
To defend against ADWS-based recon:
- Monitor SOAP traffic to ADWS endpoints.
- Restrict ADWS access to authorized IPs.
- Enable advanced auditing for `Web Service` events.
Example: Restricting ADWS via Windows Firewall
New-NetFirewallRule -DisplayName "Block Unauthorized ADWS Access" -Direction Inbound -Action Block -Protocol TCP -LocalPort 9389 -RemoteAddress "ExceptTrustedIPs"
What This Does:
- Blocks unauthorized SOAP requests to ADWS.
- Limits exposure to internal IPs only.
What Undercode Say
- Key Takeaway 1: ADWS provides a stealthier alternative to LDAP, making it ideal for red teams.
- Key Takeaway 2: Defenders must expand monitoring beyond LDAP to include SOAP-based ADWS queries.
Analysis:
ADWS represents a shift in offensive tradecraft, forcing defenders to adapt. While LDAP remains a primary detection vector, SOAP-based recon is under-monitored. Organizations should update SIEM rules, restrict ADWS access, and audit SOAP traffic to mitigate this threat.
Prediction
As detection tools improve for LDAP-based attacks, ADWS abuse will rise among advanced adversaries. Expect more SOAP-based tools (like SoaPy) to emerge, requiring defenders to integrate ADWS into threat-hunting workflows. Proactive monitoring and hardening will be critical in 2024 and beyond.
Further Reading:
This article provides actionable insights for both attackers and defenders, ensuring you stay ahead in the AD security landscape. 🚀
IT/Security Reporter URL:
Reported By: Logan Goins – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
