Dynamic Objects Misconfiguration and Usage

Detects dynamic objects and insecure Time-To-Live (TTL) configurations that allow attackers to create stealthy, self-destructing backdoors to evade standard auditing and forensic analysis.

Immediately manually delete suspicious dynamic objects to prevent forensic evasion, and restore msDS-Other-Settings TTL values to secure defaults (900 and 86400 seconds) to block ephemeral attacks

Name: Dynamic Objects Misconfiguration and Usage

Codename: C-DYNAMIC-OBJECTS

Severity: Medium

Type: Active Directory Indicator of Exposure

Family: Hygiene and Lifecycle