AD Group Changes and Membership Activity

Goksel Atakan@gokselatakan

•updated Aug 10, 2026•1•0•2

This rule monitors Active Directory security event logs for modifications to local, global, and universal groups. It specifically tracks events related to the creation, deletion, and membership changes of AD groups, providing visibility into potential privilege escalation or unauthorized administrative activity within the domain.