Windows AD Suspicious Attribute Modification

This detection monitors changes to critical Active Directory attributes: "msDS-AllowedToDelegateTo", "msDS-AllowedToActOnBehalfOfOtherIdentity", "scriptPath", and "msTSInitialProgram". Modifications to these attributes can indicate potential malicious activity, such as privilege escalation, persistence, or lateral movement attempts. The rule also notes that "msDS-KeyCredentialLink" is another important attribute for monitoring, though it may require tuning. Immediate investigation is recommended upon alert.