An AD RMS Service Group account exports the AD RMS Server Licensor Certificate private key. That 1172-byte key decrypts every document the deployment ever protected, offline, and keeps doing so after the deployment is rebuilt.

ldapnomnom claims it leaves no Windows audit logs. This post shows why Event 1644 misses LDAP Ping and where defenders can still catch it.

Discover a method for attributing Active Directory Web Services (ADWS) queries, which normally appear to originate from "localhost" in Event 1644 logs, back to the attacker's true source IP address. This is accomplished by correlating the timing of the inbound network connection event (Event 5156), which contains the real source IP, with Event 1644 within a consistent 60–80ms window.

PowerShell AD enumeration bypasses network detection by using ADWS (port 9389), logging the LDAP query (Event 1644) as localhost (::1). High-fidelity detection requires correlating Event 1644 with ADWS connection events by Operation ID to reveal the remote source and spot bulk property dumps indicated by [all_with_list].

SOAPHound uses a (!FALSE) LDAP filter pattern that breaks most detection rules. Part 4 of our detection engineering series shows exactly how to hunt for it before attackers use the blind spot.

SDFlags is an LDAP parameter most defenders walk right past in their logs. It's also how attackers enumerate permissions while evading detection. Part 3 of our series covers what Huntress found.

The detection logic was solid, the rules were deployed, and then a 2am Slack message revealed that whitespace variations in LDAP filters were breaking everything. Read Part 2 of our detection engineering series.

The gap between what attacker code looks like and what it actually logs is where most detections fail. Part 1 starts by reading the attacker's own source code.