A Hitch-hacker's Guide to DACL-Based Detections (Part 1A)

This blog post details Active Directory attack techniques and corresponding detection strategies: it walks through attacks that modify AD attributes (SPNs, delegation settings, shadow credentials, logon scripts, RDP initial programs, and GPOs), demonstrates how the modifications are performed (with tools like PowerMad, Whisker, GPOwned), and provides Splunk/SPL queries and Windows Event ID correlation patterns (5136, 4662, 4624, 5145, 4742, etc.) to detect such abuses across a domain environment.