Labs / Active Directory, defender view
Domain Admin for sixteen minutes
Group membership events show a Sales user added to Domain Admins and removed again before the nightly review. Find who did it, the time window, and the logon in between.
Briefing
The nightly Domain Admins report was clean, but a SIEM rule fired on event 4728 for the group. Adding someone, using the rights, and removing them before a scheduled check is an old trick.
Event 4728 is a member added to a global security group, 4729 is a member removed. 4732 and 4756 are the local and universal versions.
DC-01 · Active Directory, defender view
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.