win:ad
Active Directory object/replication telemetry (Admon, directory service logs)
- Host type
- Windows (workstation, member server, domain controller)
- Techniques
- 0
- Rules listed
- 41
- Events
- 0
Techniques
No ATT&CK analytic names this source.
Rules
Elastic 39
- Access to a Sensitive LDAP Attribute
- Account Configured with Never-Expiring Password
- Active Directory Forced Authentication from Linux Host - SMB Named Pipes
- Active Directory Group Modification by SYSTEM
- AdminSDHolder Backdoor
- AdminSDHolder SDProp Exclusion Added
- Creation of a DNS-Named Record
- Delegated Managed Service Account Modification by an Unusual User
- First Time Seen Account Performing DCSync
- Group Policy Abuse for Privilege Addition
- KRBTGT Delegation Backdoor
- Kerberos Pre-authentication Disabled for User
- Modification of the msPKIAccountCredentials
- Newly Observed RC4 Kerberos Service Ticket Request
- PKINIT Followed by Same-Principal U2U Service Ticket
- Potential ADIDNS Poisoning via Wildcard Record Creation
- Potential Active Directory Replication Account Backdoor
- Potential CertiGhost AD CS Machine Identity Mismatch (CVE-2026-54121)
- Potential Computer Account NTLM Relay Activity
- Potential Credential Access via DCSync
- Potential Kerberos Coercion via DNS-Based SPN Spoofing
- Potential Kerberos Relay Attack against a Computer Account
- Potential Machine Account Relay Attack via SMB
- Potential NTLM Relay Attack against a Computer Account
- Potential Privileged Escalation via SamAccountName Spoofing
- Potential Shadow Credentials added to AD Object
- Potential WPAD Spoofing via DNS Record Creation
- Remote Computer Account DnsHostName Update
- Scheduled Task Execution at Scale via GPO
- Sensitive Privilege SeEnableDelegationPrivilege assigned to a Principal
- Service Creation via Local Kerberos Authentication
- Startup/Logon Script added to Group Policy Object
- Suspicious Access to LDAP Attributes
- Suspicious Kerberos Authentication Ticket Request
- Suspicious Remote Registry Access via SeBackupPrivilege
- User Added to Privileged Group in Active Directory
- User account exposed to Kerberoasting
- WRITEDAC Access on Active Directory Object
- dMSA Account Creation by an Unusual User
Events
No event-level rows: this source is tiered as a whole.