/
← Voltar ao feed
low

TrustedSec guidance on building Active Directory logging, auditing and detection programs, with 10 detection goals

1 fonte(s) · 1 atualização(ões) · publicado 06/10/2026 01:00 · coletado há 1 dia

TrustedSec (author Brandon Colley) publishes practical guidance on building an effective logging, auditing, monitoring and alerting program for Active Directory (AD). It is based on recurring logging and auditing gaps found in the firm's AD assessments, where logging is treated as a switch to flip rather than a discipline owned by someone. The article sets out four steps in order: size the logs, configure Advanced Audit Policy, define detection goals, and find gaps through tabletop exercises. It is defensive best-practice content and describes no specific incident, vulnerability or threat actor.

Technical Details

  • Log behavior and size: On domain controllers, set "Control Event Log behavior when the log file reaches its maximum size" to Disabled for the Application, Security, Setup and System logs, so logs roll and keep collecting. Raise the maximum size above the 20MB default, using CIS minimums as a floor. Check on-box retention so it outlasts collector outages.
  • Advanced Audit Policy: Enable "Audit: Force audit policy subcategory settings to override audit policy category settings". Then configure subcategories, blending the TrustedSec recommendations with the CIS Benchmark (Windows Server 2025 v2.1.0). Roll changes out gradually to avoid log volume overwriting events before ingestion. Changes may require a domain controller restart.
  • Sysmon: Adopt it only after native auditing is stable. It adds process hashes, per-process network connections, image loads and named pipes.
  • Ten detection goals: authentication patterns (password spraying, impossible travel, UEBA); privileged account use and group membership changes; process execution and command lines (LOLBAS/LOTL); PowerShell script block logging (AMSI bypass, Invoke-Expression/IEX); DNS query logging; firewall egress logging; domain controller telemetry (Kerberoasting, AS-REP Roasting, DCSync); email gateway telemetry (SPF/DKIM/DMARC); web proxy logs; and security tool evasion signals (EDR tampering, log clearing, persistence via services and scheduled tasks).

Remediation

  • Map each of the 10 detection goals to existing tooling and sort them into three buckets: well covered, data exists but no alert written, and no telemetry. Prioritize the middle bucket.
  • Run tabletop exercises to confirm that each detection is seen, routed to someone, and actionable.
  • Update runbooks and revisit log sizes and Success/Failure audit settings.

Linha do tempo

  1. trustedsec.com ↗ · pub. 06/10/2026 01:00 · coletado 19/10 17:57 primeiro registro

    TrustedSec guidance on building Active Directory logging, auditing and detection programs, with 10 detection goals

    ler a análise desta fonte

    TrustedSec (author Brandon Colley) publishes practical guidance on building an effective logging, auditing, monitoring and alerting program for Active Directory (AD). It is based on recurring logging and auditing gaps found in the firm's AD assessments, where logging is treated as a switch to flip rather than a discipline owned by someone. The article sets out four steps in order: size the logs, configure Advanced Audit Policy, define detection goals, and find gaps through tabletop exercises. It is defensive best-practice content and describes no specific incident, vulnerability or threat actor.

    Technical Details

    • Log behavior and size: On domain controllers, set "Control Event Log behavior when the log file reaches its maximum size" to Disabled for the Application, Security, Setup and System logs, so logs roll and keep collecting. Raise the maximum size above the 20MB default, using CIS minimums as a floor. Check on-box retention so it outlasts collector outages.
    • Advanced Audit Policy: Enable "Audit: Force audit policy subcategory settings to override audit policy category settings". Then configure subcategories, blending the TrustedSec recommendations with the CIS Benchmark (Windows Server 2025 v2.1.0). Roll changes out gradually to avoid log volume overwriting events before ingestion. Changes may require a domain controller restart.
    • Sysmon: Adopt it only after native auditing is stable. It adds process hashes, per-process network connections, image loads and named pipes.
    • Ten detection goals: authentication patterns (password spraying, impossible travel, UEBA); privileged account use and group membership changes; process execution and command lines (LOLBAS/LOTL); PowerShell script block logging (AMSI bypass, Invoke-Expression/IEX); DNS query logging; firewall egress logging; domain controller telemetry (Kerberoasting, AS-REP Roasting, DCSync); email gateway telemetry (SPF/DKIM/DMARC); web proxy logs; and security tool evasion signals (EDR tampering, log clearing, persistence via services and scheduled tasks).

    Remediation

    • Map each of the 10 detection goals to existing tooling and sort them into three buckets: well covered, data exists but no alert written, and no telemetry. Prioritize the middle bucket.
    • Run tabletop exercises to confirm that each detection is seen, routed to someone, and actionable.
    • Update runbooks and revisit log sizes and Success/Failure audit settings.