All Detections

T1098 - User Added to Domain Privileged Groups

avatar
Thiago Calegari@Kl3gari
updated Oct 2, 2025154348

Detects when a user account is added to a high-privilege domain group (e.g., Domain Admins, Enterprise Admins, etc.)

Microsoft Sentinel (KQL)