Powerview Add-DomainObjectAcl DCSync AD Extend Right
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Backdooring domain object to grant the rights associated with DCSync to a regular user or machine account using Powerview\\Add-DomainObjectAcl DCSync Extended Right cmdlet, will allow to re-obtain the pwd hashes of any user/computer
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Object Changed or Network Share Accessed" AND (DISPLAYNAME = "ntSecurityDescriptor" AND CHANGES contains "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2,1131f6aa-9c07-11d1-f79f-00c04fc2dcd2,89e95b76-444d-4c62-991a-0facbeda640c") AND OBJECTTYPE != "dnsNode,dnsZoneScope,dnsZone" select Action1.HOSTNAME,Action1.MESSAGE,Action1.USERNAME,Action1.DOMAIN,Action1.TARGETDOMAIN,Action1.TARGETMACHINE,Action1.RELATIVETARGETNAME,Action1.SHARENAME,Action1.SHAREPATH,Action1.OBJECTTYPE,Action1.OBJECTNAME,Action1.CHANGES
Detection
Execution Mode
realtime
Log Sources
Active Directory
Author
Samir Bousseaden, Roberto Rodriguez @Cyb3rWard0g, oscd.community, Tim Shelton, Maxence Fossat
