Windows Security: Detect WRITE_DAC changes on Active Directory domain objects (DS/4662)

Flags AD DS Security Event 4662 activity indicating WRITE_DAC permission changes on domain objects.

FreeUnreviewedSigmacriticalv1

windows-security-detect-write-dac-changes-on-active-directory-domain-objects-ds--028c7842

title: "Windows Security: Detect WRITE_DAC changes on Active Directory domain objects (DS/4662)"
id: 9191952c-2416-4237-a8e2-708cafee0c16
status: test
description: This rule identifies Active Directory object access events where an account attempts to write discretionary access control (WRITE_DAC) against a domain object in the DS object server. WRITE_DAC changes can let an attacker modify permissions to enable further access, persistence, or privilege escalation paths. It relies on Windows Security Event ID 4662 telemetry, specifically matching ObjectServer=DS, AccessMask=0x40000, and the listed object types for a domainDNS/AD-related object.
references:
  - https://threathunterplaybook.com/hunts/windows/180815-ADObjectAccessReplication/notebook.html
  - https://threathunterplaybook.com/library/windows/active_directory_replication.html
  - https://threathunterplaybook.com/hunts/windows/190101-ADModDirectoryReplication/notebook.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_ad_object_writedac_access.yml
author: Roberto Rodriguez @Cyb3rWard0g, Huntrule Team
date: 2019-09-12
modified: 2021-11-27
tags:
  - attack.defense-impairment
  - attack.t1222.001
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4662
    ObjectServer: DS
    AccessMask: "0x40000"
    ObjectType:
      - 19195a5b-6da0-11d0-afd3-00c04fd930c9
      - domainDNS
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 028c7842-4243-41cd-be6f-12f3cf1a26c7
    type: derived

What it detects

This rule identifies Active Directory object access events where an account attempts to write discretionary access control (WRITE_DAC) against a domain object in the DS object server. WRITE_DAC changes can let an attacker modify permissions to enable further access, persistence, or privilege escalation paths. It relies on Windows Security Event ID 4662 telemetry, specifically matching ObjectServer=DS, AccessMask=0x40000, and the listed object types for a domainDNS/AD-related object.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.