AD auditing and detection
Audit policy that actually captures the events that matter, and what to alert on.
DRAFT OUTLINE. This page is a structure to fill in, not finished research.
# Lab environment
- A small home Active Directory lab (details kept general on purpose)
- [TBD: generic lab summary for this write-up: no host names, IPs or domain names]
# Advanced audit policy
- Which subcategories to enable on DCs
- [TBD: your configured policy]
# Events worth watching
- Privileged group changes
- Account lockouts and password spray patterns
- Kerberos ticket anomalies
- [TBD: event IDs and examples from your lab]
# Collecting the logs
- [TBD: forwarding / SIEM setup]
# Detections I tested
- [TBD: simulation, what fired, what didn't]
# Tuning
- [TBD: noise you filtered and why]
# References
- [TBD: sources you used]