SACL: The Detection Capability You've Been Ignoring

## Overview Marouane Aloui and Wojtek argue SOC teams overlook Windows System Access Control Lists (SACLs)—built-in auditing that closes EDR visibility gaps.

## EDR Blind Spots Endpoint tools excel at writes and deletes but often miss file reads, subtle Active Directory object access, and policy differences across agent versions—gaps discovered painfully mid-incident.

## SACL Mechanics Unlike DACLs (who may access an object), SACLs log allowed and denied attempts to the Security event log—like cameras recording every door try. They apply to files, registry keys, and AD objects without extra agents.

## Takeaways Detection engineering should instrument high-value assets with SACLs for read/access auditing, complementing EDR rather than waiting on vendor roadmaps.