A threat actor used native PowerShell (Get-ADComputer) with case obfuscation to enumerate an entire Active Directory environment, bypassing all existing LDAP-based detections. The root cause was an architectural blind spot: PowerShell uses Active Directory Web Services (ADWS) on port 9389 via encrypted SOAP/XML rather than LDAP on port 389/636. ADWS makes internal LDAP queries as localhost (::1), hiding the attacker's real IP in Event 1644 logs. The post details how to detect this by correlating five Windows event IDs (1138, 1139, 1644, 1166, 1167) using a shared Operation ID, and highlights two key indicators: the [all_with_list] attribute prefix unique to PowerShell's -Properties * parameter, and SDflags:0x7 indicating security descriptor enumeration. Network-based LDAP detection is completely blind to ADWS traffic; host-based multi-event correlation is the only viable detection approach.
