With write access to the target object’s DACL, you can grant yourself any privilege you want on the object.
With the ability to modify the DACL on the target object, you can grant yourself almost any privilege against the object you wish.
With WriteDACL over a group, grant yourself the right to add members to the group:
Add-DomainObjectAcl -TargetIdentity "Domain Admins" -Rights WriteMembers
See the abuse info for AddMembers edge for more information about execution the attack from there.
With WriteDACL over a user, grant yourself full control of the user object:
Add-DomainObjectAcl -TargetIdentity harmj0y -Rights All
See the abuse info for GenericAll over a user for more information about how to continue from there.
With WriteDACL over a computer object, grant yourself full control of the computer object:
Add-DomainObjectAcl -TargetIdentity windows1 -Rights All
See the abuse info for GenericAll over a computer for more information about how to continue from there.
With WriteDACL against a domain object, grant yourself the ability to DCSync:
Add-DomainObjectAcl -TargetIdentity testlab.local -Rights DCSync
Then perform the DCSync attack.
With WriteDACL over a GPO, grant yourself full control of the GPO:
Add-DomainObjectAcl -TargetIdentity TestGPO -Rights All
Then edit the GPO to take over an object the GPO applies to.
With WriteDACL over an OU, grant yourself full control of the OU:
Add-DomainObjectAcl -TargetIdentity (OU GUID) -Rights All
Then add a new ACE to the OU that inherits down to child objects to take over those child objects.
When using the PowerView functions, keep in mind that PowerShell v5 introduced several security mechanisms that make it much easier for defenders to see what’s going on with PowerShell in their network, such as script block logging and AMSI. You can bypass those security mechanisms by downgrading to PowerShell v2, which all PowerView functions support.
Modifying permissions on an object will generate 4670 and 4662 events on the domain controller that handled the request.
Additional opsec considerations depend on the target object and how to take advantage of this privilege.