Enhance README with detailed AD permissions information

Expanded the explanation of Active Directory permissions and added key fields for better understanding.

Author: rolling-code

README.md

@@ -589,17 +589,29 @@ Audits Active Directory ACEs that apply to a user through direct and nested secu
 .\Get-AdPrincipalPermissions.ps1 -Username "XXX\mcontestabile" -Domain "DC=YYYYYY,DC=net"
 ```
 
-Each row in the output indicates a single permission grant:
-- ObjectDN
-The exact AD container or object that holds the ACE.
-- Principal
-Either the user account or one of their groups.
-- Rights
-The bitwise rights 
-
-Keep an eye out for anything that shows 
- GenericAll or FullControl (Grants the user or group unrestricted rights over objects in sensitive OUs)
- WriteProperty or DeleteChild (Rights that allow modifying critical attributes (password resets, group membership) or removing child objects (users, computers))
+Key fields include:
+
+ObjectDN: Distinguished name of the AD object whose security descriptor contains the ACE.
+ObjectClass: Type of AD object, such as a user, group, organizational unit, computer, or Group Policy container.
+Principal: Target user or group to which the ACE applies.
+PrincipalType: Whether the matching principal is the user or an AD security group.
+Rights: Active Directory rights recorded in the ACE.
+AccessControlType: Indicates whether the ACE allows or denies the listed rights.
+IsInherited: Indicates whether the ACE is explicit on the object or inherited from a parent.
+ObjectType: Attribute, object class, property set, or extended right scoped by the ACE.
+RiskSeverity / RiskReason: Triage guidance generated by the script. These fields assist review but do not replace validation of the affected object and scoped right.
+Rights that warrant closer review
+
+Prioritize ACEs containing:
+
+GenericAll: Full control over the affected AD object.
+GenericWrite: Broad ability to modify writable properties.
+WriteDacl: Ability to change the object’s permissions and potentially grant additional access.
+WriteOwner: Ability to assume ownership and potentially alter permissions.
+WriteProperty: Ability to modify one or more attributes. Impact depends on the attribute or property set shown in ObjectType.
+ExtendedRight: A scoped control right whose impact depends on ObjectType. Some extended rights are sensitive, while others, such as Apply Group Policy, are expected and low risk.
+CreateChild / DeleteChild: Ability to create or remove specific child-object types beneath a container or OU.
+Delete / DeleteTree: Ability to delete an object or an object subtree.
 
 ---
 ### `delegated_rights.ps1`