AD Object WriteDAC Access

Severity: critical
Author: Roberto Rodriguez @Cyb3rWard0g
Source: upstream

Detects WRITE_DAC access to a domain object

MITRE ATT&CK coverage

Tactic	Techniques
Defense Evasion	`T1222.001` File and Directory Permissions Modification: Windows File and Directory Permissions Modification

Event coverage

Provider	Event ID	Title
Security-Auditing	4662	An operation was performed on an object.

Stages and Predicates

Stage 1: `selection`

ObjectType: ['19195a5b-6da0-11d0-afd3-00c04fd930c9', domainDNS]
AccessMask: 0x40000
ObjectServer: DS

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.