Windows: Dsacls.EXE Granting Over-Permissive ACL Permissions via /G

title: "Windows: Dsacls.EXE Granting Over-Permissive ACL Permissions via /G"
id: e3e3be2d-6fa5-4b0a-8eec-8ceb5612eca0
status: test
description: This rule flags process executions of dsacls.exe where the command line includes the /G grant option and permission-related flags indicative of overly permissive ACL changes (e.g., GR, GE, GW, GA, WP, WD). Granting broad or unsafe permissions can enable attackers to expand access, persist, or escalate capabilities by modifying file or object security settings. It relies on Windows process creation telemetry including the executable name and full command line contents.
references:
  - https://ss64.com/nt/dsacls.html
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771151(v=ws.11)
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dsacls_abuse_permissions.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-20
modified: 2023-02-04
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \dsacls.exe
    - OriginalFileName: DSACLS.EXE
  selection_flag:
    CommandLine|contains: " /G "
  selection_permissions:
    CommandLine|contains:
      - GR
      - GE
      - GW
      - GA
      - WP
      - WD
  condition: all of selection_*
falsepositives:
  - Legitimate administrators granting over permissive permissions to users
level: medium
license: DRL-1.1
related:
  - id: 01c42d3c-242d-4655-85b2-34f1739632f7
    type: derived