Potential Privilege Escalation via GenericAll Active Directory Rights

Dan Zero@danzero

•updated Sep 10, 2025•10•0•130

This technique involves adversaries modifying access control lists (ACLs) in Active Directory to maintain access to domain resources. Specifically, this detection identifies when a DACL (Discretionary Access Control List) is changed to grant "GenericAll" rights, which provide complete control over an AD object.