Hayabusa critical test sigma

AD Object WriteDAC Access

Detects WRITE_DAC access to a domain object

View Source

Detection Logic

{
  "security": {
    "Channel": "Security"
  },
  "selection": {
    "EventID": 4662,
    "ObjectServer": "DS",
    "AccessMask": "0x40000",
    "ObjectType": [
      "19195a5b-6da0-11d0-afd3-00c04fd930c9",
      "domainDNS"
    ]
  },
  "condition": "security and selection"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...