WriteDACL Abuse
Understand how permission to modify an Active Directory object's discretionary ACL can create a new privilege path.
Understand how permission to modify an Active Directory object's discretionary ACL can create a new privilege path.
Requirements
- WriteDACL or equivalent control over an object
- A valid domain context
- An authorized target path
Detection
- Audit directory service ACL modifications
- Alert on newly granted high-impact object rights
Remediation
- Remove unnecessary delegated ACL rights
- Review privilege paths and protect sensitive directory objects
Common tools
- BloodHound
- PowerView
- Impacket