Hunting SOAPHound: The (!FALSE) Pattern

~Huntress~
SOAPHound evades AD detection by querying non-existent attributes, logging as (! (FALSE)) in Event 1644.
-
IOCs: SOAPHound
-
#ActiveDirectory #SOAPHound #ThreatIntel

SOAPHound: Open-source tool to collect Active Directory data via ADWS - Help Net Security SOAPHound is an open-source tool for data collection, capable of enumerating Active Directory environments through the ADWS protocol.

SOAPHound: Open-source tool to collect Active Directory data via ADWS
www.helpnetsecurity.com/2024/02/08/s...
#Infosec #Security #Cybersecurity #CeptBiro #SOAPHound #OpenSourceTool #ActiveDirectory #Data #ADWS