LogScale Queries

Query

Detect after-hours changes to privileged Active Directory groups

LogScale · Detection & Monitoring · v1 · @sebastian · 2.8.2026

All Queries

Focus on additions and removals in a configurable list of privileged Active Directory groups outside local business hours. Adjust the group names, office-hour window, and IANA timezone for your environment. Source: the blog article “5 LogScale queries to audit Active Directory group changes” — https://it-selig.de/blog/logscale-queries-ad-group-changes

ActiveDirectoryDetectionMonitoringWindows

Query contentv1

Download v1
Loading editor…

Version history

Every save keeps the previous content. Open any version to view or download it.

  1. v1current

    2.8.2026, 08:00:37

Detect after-hours changes to privileged Active Directory groups | LogScale Query Exchange