AD Object ACE Modification Response (Low–Medium Impact)
Steps to collect evidence, remove the ACE, and close the attack path when an unauthorized ACE modification is detected on an unprotected individual AD object.
msDS-AllowedToActOnBehalfOfOtherIdentity attribute for resource-based constrained delegation (RBCD) (MITRE T1098) are a critical signal. Before initiating cleanup, document the legitimate business processes for all dependent services and computer accounts associated with the affected object; reverting only the ACE may not be sufficient.Prepare
6 steps- Audit policy
`Audit Directory Service Changes` (Success) and Advanced Audit Policy must be configured and enabled on DCs; otherwise Event 5136 will not be generated.
- SACL baseline
"Write" auditing via SACL must be configured on protected groups, OU roots, and high-privilege user objects.
- AdminSDHolder snapshot
`Get-Acl "AD:CN=AdminSDHolder,CN=System,DC=domain,DC=com"` output must be stored as an encrypted, immutable reference file.
- BloodHound periodic scan
A BloodHound ACL audit must have been run every 30–90 days and the dangerous ACE inventory must be current.
- Tool readiness
PowerView (`Remove-DomainObjectAcl`, `Get-DomainObjectAcl`), DSInternals, and BloodHound must be accessible for incident analysis.
- Escalation list
SOC L1 → AD administrator (T0) → IR lead → CISO; change-ticket system must be accessible.