Windows AD Domain Root ACL Modification

This rule detects modifications to the Access Control List (ACL) of the domain root object in Active Directory. Such modifications are significant and can have a high impact on the security of the Active Directory environment. The rule specifically looks for EventCode 5136 (A directory service object was modified) where the ObjectClass is 'domainDNS'. It then parses the old and new ACL values to identify specific changes, including the type of access control entry (ACE), flags, access rights, and the security identifier (SID) of the user or group affected. The rule also attempts to resolve SIDs to user or group names for better readability. Microsoft guidance suggests that all changes at this level should be reviewed.