ADAudit Plus Directory Service Object Access
Detects access to directory service objects. Bulk reads of directory objects are how an attacker maps the domain — users, groups, trusts, service principals — before deciding what to target. It is read-only activity, which means nothing breaks and nothing else is likely to alert. Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=win-audit where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS' and action='DIRECTORY_SERVICE_ACCESSED' | duration 1h | groupby user, objectclass, objecttype, domain
Sigma
