Privileged AD Group Membership Change - Potential Privilege Escalation

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•1

Detects when a user or machine account is added to a highly privileged Active Directory group. This event is often a sign of privilege escalation or persistence establishment by an adversary.