From Code to Coverage (Part 5A): When All Your Detections Fail: The ADWS Blind Spot

A real-world attack exposed how PowerShell’s use of Active Directory Web Services (ADWS) creates a blind spot, allowing complete domain enumeration to evade traditional LDAP and event log detections—proving that only multi-event correlation across ADWS and LDAP logs can reliably uncover stealthy reconnaissance activity.