All Detections

Local or Domain Group Membership Modified

avatar
Darshan Thummar@Mighty
updated Jun 16, 2026006

Detects modification of local or domain group memberships for privilege persistence

Microsoft Sentinel (KQL)