AD Object WriteDAC Access
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects WRITE_DAC access to a domain object
Severity
Critical
Rule Requirement
Criteria
Action1: actionname = "Operation Performed on Object" AND OBJECTSERVER = "DS" AND ACCESSMASK = "0x40000" AND OBJECTTYPE contains "19195a5b-6da0-11d0-afd3-00c04fd930c9,domainDNS" select Action1.HOSTNAME,Action1.MESSAGE,Action1.USERNAME,Action1.DOMAIN,Action1.ACCESSES,Action1.OBJECTNAME,Action1.OBJECTTYPE
Detection
Execution Mode
realtime
Log Sources
Active Directory
Author
Roberto Rodriguez @Cyb3rWard0g
