Windows Find Interesting ACL with Find-InterestingDomainAcl
The analytic detects the execution of the `Find-InterestingDomainAcl` cmdlet, which is part of the PowerView toolkit. This cmdlet is used to identify misconfigured or unusual Access Control Lists (ACLs) within a domain. Adversaries may use this to find privilege escalation opportunities or weak security configurations in Active Directory, potentially leading to unauthorized access or further exploitation.
Splunk (SPL)
