All Detections

Windows AD Domain Root ACL Modification

Splunk Security@SplunkSecurity
updated 3 days ago000

ACL modification performed on the domain root object, significant AD change with high impact. Following MS guidance all changes at this level should be reviewed. Drill into the logonID within EventCode 4624 for information on the source device during triage.

Splunk (SPL)