Sensitive Group Membership Change Detection
This rule detects when a member is added to or removed from highly sensitive administrative groups within Active Directory. It specifically monitors Windows Security Event IDs 4728 (member added) and 4729 (member removed) for a predefined list of critical groups such as 'Administrators', 'Domain Admins', 'Enterprise Admins', and 'Schema Admins'. The rule excludes changes made by computer accounts to reduce false positives.
Microsoft Sentinel (KQL)
