A DACL-based attack is an abuse of a discretionary access control list to gain or expand permissions on a protected object. In directory and Windows environments, an attacker may exploit weak ACEs to grant themselves read, write or takeover rights over users, groups or computers.
What DACL-Based Attack Means in Practice
A DACL-based attack is not a standalone malware family or exploit class, but an abuse of discretionary access control on an object that already exists. The attacker’s goal is to turn weak or writable permissions into additional authority, often by changing access entries on users, groups, computers, or other protected directory objects.
This matters because discretionary permissions are often inherited, delegated, or accumulated over time. A single overly broad ACE can let an attacker modify security-relevant properties rather than merely read data, which turns a configuration weakness into a path for persistence, privilege gain, or takeover.
How DACL Abuse Becomes Privilege Expansion
The key security idea is that access control lists define who can do what, and a DACL-based attack looks for places where “what” includes permission changes, not just normal object use. In Windows and directory services, this can mean writing a DACL, taking ownership, resetting a password, changing group membership, or altering attributes that confer control.
That is why these attacks are so effective against directory objects. If an attacker can edit the DACL or any linked access right that grants broader control, they can often move from a low-privilege foothold to an administrative or domain-relevant position without needing to break encryption or bypass authentication directly.
Where Organisations Become Exposed
DACL abuse usually emerges from misdelegation, inherited permissions, stale access, or object-level exceptions that were created for convenience and never revisited. The practical exposure is not limited to one account, because directory permissions can cascade through groups, service accounts, and computer objects that other systems trust.
For defenders, the most important question is whether the protected object is security-sensitive enough that permission changes would matter. If a user, group, or computer object can be rewritten by an unexpected principal, the attacker may be able to reshape the environment’s trust relationships rather than simply access one record.
Detection and Response After Permission Manipulation
Detection should focus on changes to discretionary permissions and related directory events, especially where those changes enable control over privileged identities or high-value objects. Sudden modifications to ACLs, ownership, or delegation on sensitive objects are often more important than the final abuse action itself.
After suspected exploitation, organisations should review whether the attacker gained durable authority through the DACL change. If so, the response must include checking for follow-on changes to group membership, object attributes, password resets, and other administrative actions that could survive the original foothold.
Risk and Threat Considerations
DACL abuse is dangerous because it weaponises legitimate access control mechanisms. Once an attacker can change permissions on a directory object, the compromise can shift from a single-account issue to broad authority over users, groups, computers, or delegated administrative paths.
Failure mechanism: Weak or overbroad ACEs allow an attacker to write security-relevant properties, add themselves to privileged groups, reset credentials, or take ownership of objects that should have been protected.
Impact: The result can be privilege escalation, persistence, lateral movement, and durable control of directory-backed trust relationships, especially when the abused object feeds authentication or administration elsewhere.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | DACL abuse exploits excess object permissions and delegated rights. |
| AC-2 — Account Management | Attacks often expand access by modifying accounts, groups, or delegated admin paths. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | ACL changes and takeover actions require reviewable audit evidence. | |
| Recommendation — Enforce least privilege on directory objects and review any permission that can alter access. Review account and group changes on sensitive objects for unexpected permission expansion. Monitor and investigate ACL, ownership, and delegation changes on high-value directory objects. | ||
| MITRE ATT&CK | T1222.001 — File and Directory Permissions Modification: Windows File and Directory Permissions Modification | This technique covers attacker changes to Windows permissions to gain control. |
| T1098 — Account Manipulation | DACL abuse can enable changes that manipulate accounts and delegated access. | |
| Recommendation — Map permission-modification alerts to attacker movement and review affected objects for takeover. Correlate ACL changes with account manipulation activity to spot privilege expansion. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Directory ACL abuse is fundamentally an access-control failure. |
| Recommendation — Periodically verify directory permissions and remove any unnecessary write paths to privileged objects. | ||
Practitioner Guidance
What to watch for: Treat unexpected permission changes on sensitive directory objects as a security event in their own right, not just as configuration drift. The highest-value review is usually on who can modify DACLs, ownership, or delegated rights on objects that confer administrative influence.
Governance implication: Access delegation should be explicit, reviewable, and tightly scoped, because DACL abuse often succeeds where permission inheritance and historical exceptions have gone unchallenged. For defenders, the control question is not only whether access exists, but whether it can be rewritten into more access.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 2, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org