A Hitch-hacker's Guide to DACL-Based Detections (Part 2)

This blog (Part 2 of a series) demonstrates how an attacker with a domain foothold can modify many Active Directory computer-object attributes (e.g., sAMAccountName, description, displayName, userAccountControl, dNSHostName, msDS-AdditionalDnsHostName, userParameters, altSecurityIdentities, mSMQSignCertificates/mSMQDigests) using PowerMad and other tools, and presents detection approaches using Windows Event IDs (such as 5136, 4662, 4624, 4742) and Splunk queries to detect and correlate those changes for monitoring and alerting.