AD Object WriteDAC Access

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•22

Detects attempts to modify the Discretionary Access Control List (DACL) of Active Directory objects, specifically looking for WRITE_DAC access (0x40000). This can indicate an adversary attempting to gain control over Active Directory objects, potentially for privilege escalation or persistence.