SDFLGS - THE LOG FIELD I'D BEEN IGNORING THAT UNLOCKED ATTACK PATH DETECTION

Summary from the TLDR InfoSec newsletter

SDFlags is a field that controls which security descriptor information is returned in queries and is used extensively in BloodHound and SharpHound. Querying for nTSecurityDescriptor fields (Owner, Group, DACL, or SACL) opens the door to attack path mapping. Conversely, legitimate tools almost never set SDFlags when running AD queries, opening up a new detection opportunity.