Hunt for ADWS requests from unknown devices
Hunt ADWS Requests From Unknown Device
Query
let device_info = (
// Get device network info from last 7 days
DeviceNetworkInfo
| where TimeGenerated > ago(7d)
// Expand the IP Addresses of the devices
| mv-expand todynamic(IPAddresses)
| extend IPAddress = tostring(IPAddresses.IPAddress)
// Distinct IP address for each device
| distinct DeviceName, DeviceId, IPAddress
// Search for each device if it is onboarded or not
| join kind=inner (
DeviceInfo
| where TimeGenerated > ago(7d)
| distinct DeviceName, DeviceId, OnboardingStatus
// Get the first timestamp the device was seen
| join kind=inner (
DeviceInfo
| where TimeGenerated > ago(30d)
| summarize FirstSeen = arg_min(TimeGenerated, DeviceId) by DeviceId
) on DeviceId
| project-away DeviceId1, DeviceId2
) on DeviceId, DeviceName
| project-away DeviceName1, DeviceId1
);
// Get incomming traffic on ADWS port and save unique remote IP addresses
DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where ActionType != "ListeningConnectionCreated"
| where InitiatingProcessFolderPath == @"c:\windows\adws\microsoft.activedirectory.webservices.exe"
| where LocalPort == "9389"
| summarize ConnectionTimes=make_list(TimeGenerated) by RemoteIP, DeviceName
// Get device information of remote IP addresses, results for IP we do not find information for are allowed
| join kind=leftouter device_info on $left.RemoteIP == $right.IPAddress
| project-away IPAddress
// Check if the remote IPs are onboarded devices or not
| where OnboardingStatus != "Onboarded"
// Make output better
| project DeviceName, ConnectionTimes, RemoteIP, RemoteDeviceName = DeviceName1, RemoteDeviceId = DeviceId, RemoteOnboardingStatus = OnboardingStatus, RemoteDeviceFirstSeen = FirstSeenAbout this query
Explanation
This query is designed to identify suspicious activity on a network by detecting Active Directory Web Services (ADWS) requests coming from devices that are not recognized or managed by the organization's security system, specifically Microsoft Defender for Endpoint (MDE). Here's a simple breakdown of what the query does:
-
Collect Device Information: The query first gathers network information about devices from the past 7 days, including their IP addresses and whether they are onboarded (managed) by MDE.
-
Identify ADWS Connections: It then looks for incoming network traffic on domain controllers over the ADWS port (port 9389) from the past 30 days. This traffic is specifically from the process related to Active Directory Web Services.
-
Match IP Addresses: The query attempts to match the remote IP addresses of these connections with the collected device information to determine if the source devices are onboarded.
-
Filter Unmanaged Devices: It filters out connections from devices that are not onboarded, meaning they are not recognized or managed by the organization's security tools.
-
Output Suspicious Activity: Finally, it presents a list of domain controllers that received ADWS requests from unknown or unmanaged devices, along with details like the times of connection and the first time the remote device was seen.
This query helps in identifying potential security threats by flagging unexpected ADWS requests from devices that could be used by adversaries to gather information about the network without being detected by standard monitoring tools.
Details
Robbe Van den Daele
Released: March 6, 2025
Tables
Keywords
Operators