Detection rules › Kusto
ADWS Connection from Unexpected Binary
This query first collects the IP addresses of all machines that have the Active Directory Web Services (ADWS) service running. It then searches for network connections to these IP addresses from processes that are not expected to connect to ADWS.
Known false positives
- ADWS is used by a number of legitimate applications that need to interact with Active Directory. These applications should be added to the allow-listing to avoid false positives.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Discovery | |
| Collection |
References
Telemetry coverage
Rule body
let timeframe = 2*1h;
let ADWSIPs=(
DeviceNetworkEvents
| where ingestion_time() >= ago(timeframe)
| where InitiatingProcessFolderPath == @"c:\windows\adws\microsoft.activedirectory.webservices.exe"
| where LocalPort == 9389
| distinct LocalIP
);
DeviceNetworkEvents
| where ingestion_time() >= ago(timeframe)
| where ActionType == "ConnectionSuccess"
| where RemotePort == 9389
| where RemoteIP in (ADWSIPs)
| where not(isempty(InitiatingProcessFileName))
| where not(InitiatingProcessFolderPath in~ (@"c:\windows\system32\dsac.exe", @"c:\program files\powershell\7\pwsh.exe"))
| where not(InitiatingProcessFolderPath startswith @"c:\windows\system32\windowspowershell\")
| where not(InitiatingProcessFolderPath startswith @"c:\windows\syswow64\windowspowershell\")
| where not(InitiatingProcessFolderPath startswith @"c:\program files\microsoft monitoring agent\")
// Begin environment-specific filter.
// End environment-specific filter.
Stages and Predicates
Parameters
let timeframe = 2*1h;
Let binding: ADWSIPs
let ADWSIPs = (
DeviceNetworkEvents
| where ingestion_time() >= ago(timeframe)
| where InitiatingProcessFolderPath == @"c:\windows\adws\microsoft.activedirectory.webservices.exe"
| where LocalPort == 9389
| distinct LocalIP
);
Stage 1: source
let ADWSIPs
Stage 2: source
DeviceNetworkEvents
Stage 3: where
where ...
Stage 4: where
where ActionType =~ "ConnectionSuccess"
Stage 5: where
where RemotePort == 9389
Stage 6: where
where RemoteIP =~ "ADWSIPs"
Stage 7: where
where not (isempty(InitiatingProcessFileName))
Stage 8: where
where not (InitiatingProcessFolderPath in~ (@"c:\program files\powershell\7\pwsh.exe", @"c:\windows\system32\dsac.exe"))
Stage 9: where
where not (InitiatingProcessFolderPath startswith @"c:\windows\system32\windowspowershell\")
Stage 10: where
where not (InitiatingProcessFolderPath startswith @"c:\windows\syswow64\windowspowershell\")
Stage 11: where
where not (InitiatingProcessFolderPath startswith @"c:\program files\microsoft monitoring agent\")
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
InitiatingProcessFileName | is_null | excludes:InitiatingProcessFileName | |
InitiatingProcessFolderPath | in | c:\program files\powershell\7\pwsh.exe, c:\windows\system32\dsac.exe | excludes:InitiatingProcessFolderPath field:"InitiatingProcessFolderPath" value:"c:\program files\powershell\7\pwsh.exe" field:"InitiatingProcessFolderPath" value:"c:\windows\system32\dsac.exe" |
InitiatingProcessFolderPath | starts_with | c:\windows\system32\windowspowershell\ | excludes:InitiatingProcessFolderPath field:"InitiatingProcessFolderPath" value:"c:\windows\system32\windowspowershell\" |
InitiatingProcessFolderPath | starts_with | c:\windows\syswow64\windowspowershell\ | excludes:InitiatingProcessFolderPath field:"InitiatingProcessFolderPath" value:"c:\windows\syswow64\windowspowershell\" |
InitiatingProcessFolderPath | starts_with | c:\program files\microsoft monitoring agent\ | excludes:InitiatingProcessFolderPath field:"InitiatingProcessFolderPath" value:"c:\program files\microsoft monitoring agent\" |
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
ActionType | eq |
| field:"ActionType" kind:eq value:"ConnectionSuccess" |
RemoteIP | in |
| field:"DestinationIp" kind:in value:"ADWSIPs" |
RemotePort | eq |
| field:"DestinationPort" kind:eq value:"9389" |