SOAPHound — tool to collect Active Directory data via ADWS

This report introduces SOAPHound, an Active Directory enumeration tool that uses AD Web Services (ADWS) and SOAP to avoid direct LDAP traffic and reduce detection by defensive tools. It covers the ADWS protocol stack, server-side debugging via WCF logs, message structure creation from WSDL, and robust handling of nTSecurityDescriptor parsing using a prebuilt SID/GUID cache. The authors outline performance and stealth optimizations (limited attribute selection, autosplitting queries to avoid timeouts) and document four collection modes: building a cache, dumping BloodHound-compatible data, harvesting ADCS data, and extracting AD-integrated DNS records, with example commands and LDAP filters.