Potentially Over Permissive Permissions Granted Using Dsacls.EXE

Title: Potentially Over Permissive Permissions Granted Using Dsacls.EXE
Status: test
Description:Detects usage of Dsacls to grant over permissive permissions
References:
  -https://ss64.com/nt/dsacls.html
  -https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771151(v=ws.11)
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-20
modified:2023-02-04
Tags:

• -'attack.stealth'
• -'attack.t1218'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\dsacls.exe' OriginalFileName:'DSACLS.EXE'   selection_flag:
    CommandLine|contains: ' /G '
  selection_permissions:
    CommandLine|contains:
      -'GR'
      -'GE'
      -'GW'
      -'GA'
      -'WP'
      -'WD'

  condition:all of selection_*
Falsepositives:
  -Legitimate administrators granting over permissive permissions to users
Level: medium