Potentially Over Permissive Permissions Granted Using Dsacls.EXE — Sigma Rule

Rule metadata and linked tags

Author: Nasreddine Bencherchali (Nextron Systems). Source status: test; severity: medium. Source dates: 2022-06-20 / 2023-02-04.

{
  "category": "process_creation",
  "product": "windows"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: e4a37870ef5e853f1d056d1e4ac61e22f8f0cf7ed0eb6c27f5e974c70116cd49

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Potentially Over Permissive Permissions Granted Using Dsacls.EXE
id: 01c42d3c-242d-4655-85b2-34f1739632f7
status: test
description: Detects usage of Dsacls to grant over permissive permissions
references:
    - https://ss64.com/nt/dsacls.html
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771151(v=ws.11)
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-06-20
modified: 2023-02-04
tags:
    - attack.stealth
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\dsacls.exe'
        - OriginalFileName: "DSACLS.EXE"
    selection_flag:
        CommandLine|contains: ' /G '
    selection_permissions:
        CommandLine|contains: # Add more permissions as you see fit in your environment
            - 'GR'
            - 'GE'
            - 'GW'
            - 'GA'
            - 'WP'
            - 'WD'
    condition: all of selection_*
falsepositives:
    - Legitimate administrators granting over permissive permissions to users
level: medium

Original YAML and metadata in JSON

False positives

• Legitimate administrators granting over permissive permissions to users

Source references

• https://ss64.com/nt/dsacls.html
• https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771151(v=ws.11)