Windows AD Dangerous Deny ACL Modification

This detection identifies an Active Directory access-control list (ACL) modification event, specifically focusing on changes that apply deny permissions to prevent enumeration of object permissions. Such modifications can be used by adversaries for persistence or to hide malicious objects within Active Directory by making them harder to discover.