Best Detection of 2026 Series: Bulk AD Object Deletion or ADFS/AD CS Service Stop by Privileged Account

Ibrahim Saud@tektrix

•updated 9 days ago•1•0•1

Detects suspicious administrative activity involving privileged users performing bulk account/object deletions or stopping critical identity-related services (ADFS, Active Directory Certificate Services). The rule specifically flags events occurring outside standard business hours, involving privileged AD groups, or directly targeting identity infrastructure, indicating a potential attempt to disrupt authentication services or sabotage identity management.