Adversaries can interact with the DACLs using built-in Windows commands takeown which can grant adversaries higher permissions on specific files and folders

Detects a file or folder's permissions being modified or tampered with.

Detects WRITE_DAC access to a domain object