The 60ms Window: How Event 5156 Solves the ADWS Attribution Problem

This research demonstrates a practical detection technique to attribute ADWS-based Active Directory enumeration back to source IPs by correlating Windows Event 5156 (network connection), Event 1138 (ADWS session), and Event 1644 (LDAP query). The author validates a consistent ~60–80 ms timing window for correlation, provides a PowerShell script to automate attribution, and explains how SIEM log retention and pattern-based filtering reduce RSAT false positives.