Over time, both targeted and large-scale enumeration of Active Directory (AD) environments have become increasingly detected due to modern defensive solutions. During our internship at X-Force Red this past summer, we noticed FalconForce’s SOAPHound was becoming popular for enumerating Active Directory environments. This tool brought a new perspective to Active Directory enumeration by performing collection via Active Directory Web Services (ADWS) instead of directly through Lightweight Directory Access Protocol (LDAP) as other AD enumeration tools had in the past. We were interested in expanding the use cases of this tradecraft, which eventually led us to simplify interaction with ADWS from Linux hosts through the development of a portable library written in Python and a custom tool for utilizing said library that we named SoaPy.
SoaPy: Stealthy enumeration of Active Directory environments through ADWS