huntrule

Suspicious Active Directory Web Services Query from Localhost via SOAPHound

PremiumReviewedSigma · Low · v1
Product
windows
Service
security
Author
HuntRule
Published
2026-10-01
Updated
2026-10-01
AnalysisDetection

ATT&CK techniques

Discovery

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects Directory Service event 1644 activity attributed to a client connecting from the IPv6 loopback address over the Active Directory Web Services path, the local ADWS proxying behavior SOAPHound uses to relay LDAP through port 9389. Running the collector on a domain controller and querying ADWS via localhost obscures the true source of enumeration. A loopback ADWS client issuing bulk directory queries is anomalous and suggests on-host reconnaissance tooling.

Reporting behind it

Related detections9 linkedT1087.002 — drag to rearrange
Suspicious SOAPHound Style LDAP Query with SDflags and all_with_list via security
Suspicious SOAPHound Null Filter LDAP Query via security
Suspicious LDAP Security Descriptor Enumeration via SD_FLAGS Control
Suspicious LDAP Query Enumerating Kerberos Preauth Disabled Accounts with Whitespace Evasion
Suspicious Delegation Discovery LDAP Search Filter via Bitwise OID
Suspicious PowerShell Execution of Untitled1 Script From ProgramData
Suspicious Notepad Access to Active Directory Enumeration Output Files
Suspicious Service Principal Name Discovery via setspn Query
Suspicious Domain Admins Enumeration via Net Group
Suspicious Active Directory Web Services Query from Localhost via SOAPHound
Pivot detection · T1087.002 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.