Query
Detect after-hours changes to privileged Active Directory groups
LogScale · Detection & Monitoring · v1 · @sebastian · 2.8.2026
Focus on additions and removals in a configurable list of privileged Active Directory groups outside local business hours. Adjust the group names, office-hour window, and IANA timezone for your environment. Source: the blog article “5 LogScale queries to audit Active Directory group changes” — https://it-selig.de/blog/logscale-queries-ad-group-changes
ActiveDirectoryDetectionMonitoringWindows
Query contentv1
Download v1Loading editor…
Version history
Every save keeps the previous content. Open any version to view or download it.