ADAudit Plus Sensitive User Account Attribute Changed

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects modification of user account attributes in Active Directory. Attribute changes are how durable access is engineered quietly: disabling pre-authentication, setting a service principal name, or clearing password expiry each weaken an account without creating a new one for anybody to notice. Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=iam where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS' and action='USER_ACCOUNT_CHANGED' | groupby user, targetuser, accountdomain, category, role