wtf is adwshound?

ADWSHound is a security research tool written in Python for mapping out a Windows Active Directory environment, the system many organizations use to manage user accounts, computers, and permissions on their network. It collects the same kind of information as a well known tool called SharpHound and produces output that can be loaded into BloodHound, a popular tool for visualizing Active Directory relationships and attack paths. What makes ADWSHound different is how it asks the directory for that information. Instead of using LDAP, the traditional and heavily monitored protocol most collection tools rely on, it communicates over ADWS, a lesser watched Microsoft protocol that runs on a different network port. The README states this makes the tool quieter and more likely to avoid security controls that specifically watch for LDAP based enumeration. The tool supports logging in with a password, a technique called pass the hash, or Kerberos authentication, and it includes several settings meant to reduce how noisy or detectable its activity is, such as reusing network connections, obfuscating its search filters, and adding delays between requests. It can collect many categories of information, including group memberships, permissions, organizational unit structure, domain trusts, computer sessions, and certificate authority configuration, and some of these collection methods can pull data purely over ADWS while others still require the more common SMB network protocol on port 445. Using it requires Python 3.10 or newer along with several Python libraries for handling network protocols and authentication, listed in a requirements file that can be installed with pip. It is meant for security professionals conducting authorized assessments of Active Directory environments, and its author has written a separate blog post explaining the underlying protocol and the tradeoffs of using it this way in more detail. The README included in this source does not state a software license.