Windows Password Spraying Attempt via DSACLS.EXE

Flags dsacls.exe executions that specify both /user: and /passwd:, consistent with password spraying attempts.

FreeUnreviewedSigmamediumv1

windows-password-spraying-attempt-via-dsacls-exe-bac9fb54

title: Windows Password Spraying Attempt via DSACLS.EXE
id: 8781ffa2-9664-470e-a6b0-0972e52a6d58
status: test
description: "This rule flags process executions of dsacls.exe where the command line includes both /user: and /passwd: parameters. An attacker can use these inputs to test or attempt authentication across multiple accounts with a single tool, characteristic of password spraying behavior. The detection relies on Windows process creation telemetry, specifically the executable name and command-line arguments."
references:
  - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/using-dsacls-to-check-ad-object-permissions#password-spraying-anyone
  - https://ss64.com/nt/dsacls.html
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771151(v=ws.11)
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dsacls_password_spray.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-20
modified: 2023-02-04
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \dsacls.exe
    - OriginalFileName: DSACLS.EXE
  selection_cli:
    CommandLine|contains|all:
      - "/user:"
      - "/passwd:"
  condition: all of selection*
falsepositives:
  - Legitimate use of dsacls to bind to an LDAP session
level: medium
license: DRL-1.1
related:
  - id: bac9fb54-2da7-44e9-988f-11e9a5edbc0c
    type: derived

What it detects

This rule flags process executions of dsacls.exe where the command line includes both /user: and /passwd: parameters. An attacker can use these inputs to test or attempt authentication across multiple accounts with a single tool, characteristic of password spraying behavior. The detection relies on Windows process creation telemetry, specifically the executable name and command-line arguments.

Known false positives

Legitimate use of dsacls to bind to an LDAP session

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.