Attempt to Modify Active Directory Object Permissions
This rule detects attempts to modify or access sensitive Active Directory objects by monitoring Windows Security Event Code 4662 (An operation was performed on an object). Specifically, it looks for an Access Mask of 0x100, which indicates a 'Write Property' operation. The rule then filters for specific Object Types (GUIDs) that correspond to sensitive Active Directory objects, such as those related to domain controllers, group policy objects, or other critical infrastructure. To reduce false positives, it excludes activity from known system accounts like 'Window Manager', 'NT AUT*', 'MSOL_*', and machine accounts ending with '$'.
Splunk (SPL)
