Active Directory Object Access with Specific Object Types

nomit vyas@xoxo

•updated Feb 23, 2026•2•0•28

This rule detects attempts to access specific Active Directory object types (identified by their GUIDs) with an access mask of 0x100 (which typically indicates 'Write Property' access). It filters out common service accounts and system accounts to reduce noise.