Uncommon ADWS (Port 9389) Connections from Non-Standard Windows Binaries

Alerts on unexpected process-to-ADWS (TCP/9389) connections on Windows to highlight potential directory discovery.

FreeReviewedSigma · Medium · v2

Product: windows
Category: network_connection
Author: @kostastsale (SigmaHQ), DRL 1.1
Published: 2024-01-26
Updated: 2026-07-31

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1087Account Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags network connections to Active Directory Web Services using TCP port 9389 when the initiating process is not one of the expected ADWS management binaries. Attackers may use ADWS to query or discover Active Directory data, so uncommon process-to-ADWS communication can indicate misuse. The rule relies on Windows network connection telemetry (destination port and initiated connection) and process image path context to identify unexpected callers.

Reporting behind it

Related detections9 linkedT1087 — drag to rearrange

Suspicious Active Directory Discovery via ADFind

Suspicious Active Directory Enumeration via Sysinternals AD Explorer Snapshot (via process_creation)

Suspicious SimpleHelp Remote Access Client Spawning Discovery Commands (via process_creation)

Windows Process Creation: SOAPHound Execution via AD Data Collection Command-Line Arguments

Windows Process Creation Signals for Pikabot System Discovery

Windows PowerShell module commandlet names matching known exploitation and post-exploitation tooling

Windows Process Creation: Suspicious PowerShell Commandlets Used by Known Exploitation Tools

Windows Process Creation: Seatbelt.exe PUA Discovery Command-Line Execution

Windows Process Creation: China Chopper Webshell Command Pattern via W3WP

Uncommon ADWS (Port 9389) Connections from Non-Standard Windows Binaries

Pivot detection · T1087 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-uncommon-network-connections-to-ad-web-services-adws-from-non-standard-p-b3ad3c0f

title: Uncommon ADWS (Port 9389) Connections from Non-Standard Windows Binaries
id: 35cf1576-467b-43b2-aa74-69cd88743748
status: test
description: This rule flags network connections to Active Directory Web Services using TCP port 9389 when the initiating process is not one of the expected ADWS management binaries. Attackers may use ADWS to query or discover Active Directory data, so uncommon process-to-ADWS communication can indicate misuse. The rule relies on Windows network connection telemetry (destination port and initiated connection) and process image path context to identify unexpected callers.
references:
  - https://medium.com/falconforce/soaphound-tool-to-collect-active-directory-data-via-adws-165aca78288c
  - https://github.com/FalconForceTeam/FalconFriday/blob/a9219dfcfd89836f34660223f47d766982bdce46/Discovery/ADWS_Connection_from_Unexpected_Binary-Win.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_adws_unusual_connection.yml
author: "@kostastsale, Huntrule Team"
date: 2024-01-26
tags:
  - attack.discovery
  - attack.t1087
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: true
    DestinationPort: 9389
  filter_main_dsac:
    Image: C:\Windows\system32\dsac.exe
  filter_main_ms_monitoring_agent:
    Image: C:\Program Files\Microsoft Monitoring Agent\
  filter_main_powershell:
    Image|startswith:
      - C:\Program Files\PowerShell\7\pwsh.exe
      - C:\Program Files\PowerShell\7-preview\pwsh.ex
      - C:\Windows\System32\WindowsPowerShell\
      - C:\Windows\SysWOW64\WindowsPowerShell\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - ADWS is used by a number of legitimate applications that need to interact with Active Directory. These applications should be added to the allow-listing to avoid false positives.
level: medium
license: DRL-1.1
related:
  - id: b3ad3c0f-c949-47a1-a30e-b0491ccae876
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL