Potentially Over Permissive Permissions Granted Using Dsacls.EXE
This rule detects the use of the 'dsacls.exe' utility to grant potentially over-permissive permissions on Active Directory objects. It specifically looks for the execution of 'dsacls.exe' with the '/G' flag, which is used to grant permissions, combined with common permission flags like 'GR' (Generic Read), 'GE' (Generic Execute), 'GW' (Generic Write), 'GA' (Generic All), 'WP' (Write Property), or 'WD' (Write DACL). This combination suggests an attempt to broaden access controls, which could be a legitimate administrative action or an adversary attempting to escalate privileges or maintain persistence.
Sigma
