Powerview Add-DomainObjectAcl DCSync AD Extended Right

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•3•0•32

This rule detects attempts to backdoor a domain object by granting DCSync rights to a regular user or machine account. This is achieved by modifying the 'ntSecurityDescriptor' attribute in Active Directory, specifically looking for GUIDs associated with DCSync extended rights. Such a modification allows the designated account to perform DCSync attacks, enabling the retrieval of password hashes for any user or computer in the domain.