easy5 pts · first answer countsdetection-engineeringwindows-event-logsactive-directory
A user added to Domain Admins
Which event ID on a domain controller records a member being added to a security-enabled global group such as Domain Admins?
Discussion 0
Join free to post in the discussion.
Related questions
- What is Windows Event ID 4624?Cybersecurity Analyst
- False positive or false negative?Cybersecurity Analyst
- What is Sysmon Event ID 1?Cybersecurity Analyst
- What detection as code gives youCybersecurity Analyst
- The logsource block in a Sigma ruleCybersecurity Analyst
- Reading a selection and filter conditionCybersecurity Analyst
- What the contains modifier doesCybersecurity Analyst
- Why match Image with endswithCybersecurity Analyst