Windows compares the requested rights for an object with the identities and enabled groups in the effective token and the object's security descriptor. DACL entries are evaluated in order for those rights. A null DACL allows access, while an empty DACL grants no access through its entries. Integrity policy and restricted token checks can impose additional limits. Privileges authorize particular operations, but do not bypass every access check. The rules below select requests, descriptor changes, inspections, and audited access. Check the event type and fields before treating any request as a completed operation.
- Security Event ID 4656: Handle requested
- Security Event ID 4657: Registry value modified
- Security Event ID 4663: Access rights exercised (no failure events)
- Security Event ID 4670: Object permissions changed
- Security Event ID 4674: Privileged object operation attempted
- Security Event ID 4907: Object SACL auditing settings changed
Ownership and ACL Requests #
Commands and scripts request ownership or ACL operations without establishing the resulting owner or granted rights.
- File or Folder Permissions Modifications Sigma
Detects a file or folder's permissions being modified or tampered with.
- PowerShell Script Change Permission Via Set-Acl - PsScript Sigma
Detects PowerShell scripts set ACL to of a file or a folder
- PowerShell Set-Acl On Windows Folder - PsScript Sigma
Detects PowerShell scripts to set the ACL to a file in the Windows folder
- Suspicious Recursive Takeown Sigma
Adversaries can interact with the DACLs using built-in Windows commands takeown which can grant adversaries higher permissions on specific files and folders
Service and SCM Security Requests #
Descriptor commands address service objects or the SCM database rather than their registry key permissions.
No rules currently have sufficient source evidence for selection in this section.
Registry and Event Log Permission Evidence #
Registry permission events and descriptor requests include distinct legacy Eventlog CustomSD and WINEVT ChannelAccess configuration evidence.
No rules currently have sufficient source evidence for selection in this section.
Audit Policy and SACL Requests #
Auditpol /set /sd requests an audit policy descriptor change, while /resourceSACL requests global resource auditing changes.
No rules currently have sufficient source evidence for selection in this section.
Permission Inspection #
Command and script evidence requests permission information without establishing weak permissions.
- Service Registry Permissions Weakness Check Sigma
Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services
Object Access and Permission Events #
Handle requests, exercised rights, permission changes, and selected SCM privileged access record distinct operations.
- SCM Database Privileged Operation Sigma
Detects non-system users performing privileged operation os the SCM database
References #
- [1] Microsoft Learn: Security Descriptors
- [2] Microsoft Learn: auditpol set
- [3] Microsoft Learn: Service Security and Access Rights
- [4] Microsoft Learn: auditpol resourceSACL
- [5] Microsoft Learn: Event Logging Security
- [6] Microsoft Learn: EVT_CHANNEL_CONFIG_PROPERTY_ID
- [7] Microsoft Learn: Mandatory Integrity Control
- [8] Microsoft Learn: Restricted Tokens