Windows Security: Detect WRITE_DAC on AD DS objects (Event ID 4662)

Flags AD DS Security Event 4662 activity indicating WRITE_DAC permission changes on domain objects.

FreeReviewedSigma · Critical · v2

Product: windows
Service: security
Author: Roberto Rodriguez @Cyb3rWard0g (SigmaHQ), DRL 1.1
Published: 2019-09-12
Updated: 2026-07-31

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1222.001Windows Permissions
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Active Directory Domain Services object access events where an account granted WRITE_DAC rights (AccessMask 0x40000) to an object in the DS object server. Modifying discretionary access control lists can enable attackers to change who has permissions, facilitating defense impairment or persistence. Detection relies on Windows Security audit event 4662 telemetry with ObjectServer=DS and specific ObjectType GUIDs for the affected AD DS objects.

Reporting behind it

Related detections9 linkedT1222.001 — drag to rearrange

Suspicious File Permission Grant to Everyone via Icacls (via process_creation)

Suspicious Permissions Modification on a Network Share (via security)

Malicious Computer Account Modifying Active Directory Permissions - PrivExchange (via security)

Suspicious Recursive icacls Grant of Full Access to Everyone via process_creation

Malicious Replication Privileges Granted to Perform DCSync Attack (via security)

Windows: fsutil SymlinkEvaluation behavior modification via command line

Windows Suspicious takeown.exe Recursive Ownership Change

Windows Process Creation: File/Folder Permission Changes via cacls/icacls/net attrib/takeown

Windows process activity matching WannaCry executables and ransom note text

Windows Security: Detect WRITE_DAC on AD DS objects (Event ID 4662)

Pivot detection · T1222.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-security-detect-write-dac-changes-on-active-directory-domain-objects-ds--028c7842

title: "Windows Security: Detect WRITE_DAC on AD DS objects (Event ID 4662)"
id: 9191952c-2416-4237-a8e2-708cafee0c16
status: test
description: This rule identifies Active Directory Domain Services object access events where an account granted WRITE_DAC rights (AccessMask 0x40000) to an object in the DS object server. Modifying discretionary access control lists can enable attackers to change who has permissions, facilitating defense impairment or persistence. Detection relies on Windows Security audit event 4662 telemetry with ObjectServer=DS and specific ObjectType GUIDs for the affected AD DS objects.
references:
  - https://threathunterplaybook.com/hunts/windows/180815-ADObjectAccessReplication/notebook.html
  - https://threathunterplaybook.com/library/windows/active_directory_replication.html
  - https://threathunterplaybook.com/hunts/windows/190101-ADModDirectoryReplication/notebook.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_ad_object_writedac_access.yml
author: Roberto Rodriguez @Cyb3rWard0g, Huntrule Team
date: 2019-09-12
modified: 2021-11-27
tags:
  - attack.defense-impairment
  - attack.t1222.001
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4662
    ObjectServer: DS
    AccessMask: "0x40000"
    ObjectType:
      - 19195a5b-6da0-11d0-afd3-00c04fd930c9
      - domainDNS
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 028c7842-4243-41cd-be6f-12f3cf1a26c7
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL