New rules suggested for AD Container WRITE_DAC & WRITE_OWNER detection + DNS Server DLL injection

rules/windows/builtin/security/win_security_ad_adminsdholder_writedac.yml

@@ -0,0 +1,30 @@
+title: AdminSDHolder WriteDAC
+id: 57bc5954-f99b-44b5-a5e9-fb061e6d3532
+description: Detects WRITE_DAC to AdminSDHolder object > possible AdminSDHolder Backdooring
+kind: evtx
+status: experimental
+date: 2023/11/30
+author: Charles BLANC-ROLIN @woundride
+references:
+    - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/how-to-abuse-and-backdoor-adminsdholder-to-obtain-domain-admin-persistence
+    - https://learn.microsoft.com/en-us/windows/win32/secauthz/standard-access-rights
+tags:
+    - attack.defense_evasion
+    - attack.t1222.001
+    - attack.t1098 
+logsource:
+    product: windows
+    service: security
+detection:
+    selection: 
+        EventID: 4662
+        ObjectServer: 'DS'
+        AccessMask: '0x40000'
+        ObjectType|contains:
+            - 'bf967a8b-0de6-11d0-a285-00aa003049e2'
+        ObjectName|contains:
+            - '80324499-e1db-4754-aac9-824caef211f4'
+    condition: selection
+falsepositives:
+    - Unknown
+level: critical