Ransomware Series: SharpADWS-Style Active Directory Enumeration via ADWS Port 9389

Ibrahim Saud@tektrix

•updated Sep 25, 2026•2•0•7

Detects processes attempting to enumerate Active Directory objects (users, groups, trusts) while simultaneously establishing a network connection to Active Directory Web Services (ADWS) on port 9389. This behavior is characteristic of tools like SharpADWS, which performs AD enumeration via the ADWS protocol rather than traditional LDAP, potentially bypassing legacy detection mechanisms.