AD Object WriteDAC Access
Detects WRITE_DAC access to a domain object
Detection logic
selection
EventID: 4662
ObjectServer: DS
AccessMask: "0x40000"
ObjectType:
- 19195a5b-6da0-11d0-afd3-00c04fd930c9
- domainDNSCondition
selectionRaw YAML
title: AD Object WriteDAC Access
id: 028c7842-4243-41cd-be6f-12f3cf1a26c7
status: test
description: Detects WRITE_DAC access to a domain object
references:
- https://threathunterplaybook.com/hunts/windows/180815-ADObjectAccessReplication/notebook.html
- https://threathunterplaybook.com/library/windows/active_directory_replication.html
- https://threathunterplaybook.com/hunts/windows/190101-ADModDirectoryReplication/notebook.html
author: Roberto Rodriguez @Cyb3rWard0g
date: 2019-09-12
modified: 2021-11-27
tags:
- attack.defense-impairment
- attack.t1222.001
logsource:
product: windows
service: security
detection:
selection:
EventID: 4662
ObjectServer: 'DS'
AccessMask: '0x40000'
ObjectType:
- '19195a5b-6da0-11d0-afd3-00c04fd930c9'
- 'domainDNS'
condition: selection
falsepositives:
- Unknown
level: criticalFalse positives
- Unknown