Windows AD Domain Root ACL Deletion

This rule detects the deletion of Access Control List (ACL) entries on the domain root object within Active Directory. Such an action is a significant change with high impact, as it can alter fundamental security permissions for the entire domain. Microsoft guidance suggests that all changes at this level should be reviewed. The rule extracts details about the old and new ACL values, the operation type, the affected object, and the user performing the action. It also attempts to resolve SIDs to user or group names for better context.