A Hitch-Hacker's Guide To DACL-Based Detections - The Addendum

This blog post documents several Active Directory attributes (e.g., operatingSystem, operatingSystemVersion, entryTTL, userPrincipalName, userCertificate), demonstrates how an attacker with sufficient domain privileges can modify them (using tools like PowerMad, Impacket, LDIFDE and dynamicObject creation), and provides Splunk/SPL detection queries and guidance for auditing and baselining to detect such changes.