Evidence of Active Directory Web Services enumeration is usually found in domain controller authentication and service logs, plus any directory service telemetry that records remote queries. Look for unusual query volume, repetitive identity lookups, and access from hosts that do not normally use ADWS-based administration. The most useful records are the ones that show who queried what, from where, and when.
Where ADWS evidence shows up in practice
ADWS enumeration usually leaves a trail in domain controller logs and directory service telemetry, not in a single dedicated “ADWS enumeration” event. The useful signal is repeated remote directory queries against domain controllers, especially when the source host is unusual for administrative access or when the query pattern is broader than normal management activity. Active Directory and Entra ID Hardening Guide is a good companion when you are mapping those queries back to expected admin paths and Tier 0 exposure.
Look for records that tie together a requester, a target domain controller, and the directory objects or namespaces being queried. Authentication logs help identify the session that established access, while service and directory logs help show whether the activity was a normal admin lookup or a burst of systematic enumeration. In practice, the value is in correlating source host, account, timing, and query repetition rather than relying on any one log line alone.
What the log pattern usually looks like
The most suspicious pattern is repetitive, high-volume lookup activity that follows a discovery rhythm, such as many near-identical queries across users, groups, computers, or domain configuration data. That pattern often appears when a tool is walking the directory to map identities, privileges, trusts, or service relationships. Top 10 Active Directory Security Risks helps frame why this kind of broad directory visibility matters, because enumeration often precedes privilege targeting or lateral movement.
You should also treat access from hosts that do not normally perform ADWS-based administration as important context. Workstations used by help desk, jump servers, identity admins, and automation hosts may be expected; ordinary user endpoints usually are not. When the querying source is out of profile and the query cadence is mechanical, the odds increase that the activity is reconnaissance rather than routine administration.
Cloud Logging and Audit Trail Guide is useful here because the same correlation discipline applies across identity telemetry: fidelity, retention, and the ability to tie activity back to a stable source are what make enumeration visible.
How to confirm and investigate ADWS enumeration
Start by confirming whether the querying account and source host are expected to use ADWS at all. Then compare the observed pattern with normal administrative behavior: the same account, the same host, and the same scope of queries should recur in predictable ways for legitimate administration. If the source is new, the query volume is bursty, or the target set is unusually broad, treat it as a candidate reconnaissance event.
From there, check whether the activity is isolated or part of a wider identity attack path. ADWS enumeration often sits near the beginning of compromise chains that lead to privilege discovery, trust abuse, credential targeting, or post-compromise navigation. If you find repeated directory lookups alongside sign-in anomalies, suspicious service use, or follow-on access attempts, widen the review to adjacent logs on the domain controller and the originating endpoint.
Attack Surface Management Guide also fits the investigation workflow because exposed services and unexpected administrative surfaces are often what make directory reconnaissance easier to execute and harder to notice.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1087 — Account Discovery | ADWS enumeration is directory reconnaissance over accounts and groups. |
| T1069 — Permission Groups Discovery | ADWS queries often enumerate privileged groups and nested membership. | |
| Recommendation — Map repeated directory queries to Account Discovery and hunt for follow-on privilege targeting. Correlate group lookups with privileged group discovery and review nested memberships for abuse paths. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Investigating ADWS enumeration depends on reviewing correlated audit records. |
| IA-2 — Identification and Authentication (Organizational Users) | Unexpected authenticated admin-like access is central to suspicious ADWS activity. | |
| Recommendation — Review and correlate controller and directory logs to identify unusual query volume and source hosts. Validate that the account used for directory queries is approved for that administrative role. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | ADWS evidence depends on retained, searchable domain controller and directory logs. |
| Recommendation — Centralize and retain controller logs so repetitive directory queries can be investigated. | ||
Practitioner Guidance
What to prioritise: Prioritise correlation over single-event hunting. ADWS enumeration is most defensible when you can line up the query source, the account used, the target objects, and the timing pattern across domain controller and directory service logs.
What to verify: Verify whether the source host is an approved admin station, jump host, or automation system. If it is not, treat repeated directory lookups as higher-signal than a generic authentication success.
Common mistake: Do not stop at “authentication happened.” Enumeration is about directory visibility and query behavior, so the important question is whether the requester is systematically mapping objects or just performing a normal management task.
Practitioner takeaway: The strongest evidence of ADWS enumeration is a patterned set of directory queries from an unexpected source, tied to an account that should not be browsing the directory at that scale.
Related resources from NHI Mgmt Group
- Why does Active Directory Certificate Services increase identity risk?
- How should teams decommission legacy Active Directory forests without breaking business services?
- What breaks when Active Directory Certificate Services templates are too permissive?
- What breaks when Active Directory attacks are only monitored through SIEM logs?