AD Object WriteDAC Access

Title: AD Object WriteDAC Access
Status: test
Description:Detects WRITE_DAC access to a domain object
References:
  -https://threathunterplaybook.com/hunts/windows/180815-ADObjectAccessReplication/notebook.html
  -https://threathunterplaybook.com/library/windows/active_directory_replication.html
  -https://threathunterplaybook.com/hunts/windows/190101-ADModDirectoryReplication/notebook.html
Author: Roberto Rodriguez @Cyb3rWard0g
Date: 2019-09-12
modified:2021-11-27
Tags:

• -'attack.defense-impairment'
• -'attack.t1222.001'

Logsource:

• product: windows
• service: security

Detection:
  selection:
    EventID: '4662'
    ObjectServer: 'DS'
    AccessMask: '0x40000'
    ObjectType:
      -'19195a5b-6da0-11d0-afd3-00c04fd930c9'
      -'domainDNS'

  condition:selection
Falsepositives:
  -Unknown
Level: critical