Defender-IdentityDirectoryEvents

ActionType	Title	Sample	Rule
any	Directory service activity	N	N
Account Constrained Delegation SPNs changed	Account constrained delegation SPNs changed	N	N
Account Constrained Delegation State changed	Account constrained delegation state changed	N	N
Account Delegation changed	Account delegation changed	N	N
Account Deleted changed	Account deleted changed	N	N
Account disabled	Account disabled	N	N
Account Disabled changed	Account disabled changed	N	N
Account Display Name changed	Account display name changed	N	N
Account enabled	Account enabled	N	N
Account expired	Account expired	N	N
Account Expiry Time changed	Account expiry time changed	N	N
Account Name changed	Account name changed	N	N
Account password change failed	Account password change failed	N	N
Account Password changed	Account password changed	N	N
Account Password expired	Account password expired	N	N
Account Password Never Expires changed	Account password never expires changed	N	N
Account Password Not Required changed	Account password not required changed	N	N
Account Path changed	Account path changed	N	N
Account primary group ID changed	Account primary group ID changed	N	N
Account Smart Card Required changed	Account smart card required changed	N	N
Account Supported Encryption Types changed	Account supported encryption types changed	N	N
Account Unlock changed	Account unlock changed	N	N
Account Upn Name changed	Account UPN name changed	N	N
Active Directory security group created	Active Directory security group created	N	N
ADCS certificate issued	ADCS certificate issued	N	N
ADFS DKM property read	ADFS DKM property read	N	N
ADFS settings changed	ADFS settings changed	N	N
DES encryption restriction changed	DES encryption restriction changed	N	N
Device Account Created	Device account created	N	N
Device dNSHostName changed	Device DNS host name changed	N	N
Device Operating System changed	Device operating system changed	N	N
Directory Service replication	Directory service replication	N	N
Domain trusts enumerated	Domain trusts enumerated	N	N
Entra Connect password writeback failed	Entra Connect password writeback failed	N	N
GMSA password read	GMSA password read	N	N
Group Membership changed	Group membership changed	N	N
Group Policy display name changed	Group Policy display name changed	N	N
Group Policy Object created	Group Policy object created	N	N
Group Policy Object deleted	Group Policy object deleted	N	N
Group Policy settings changed	Group Policy settings changed	N	N
Kerberos preauthentication flag changed	Kerberos preauthentication flag changed	N	N
Plaintext password allow status changed	Plaintext password allow status changed	N	N
Potential lateral movement path identified	Potential lateral movement path identified	N	N
PowerShell execution	PowerShell execution	N	N
Private Data Retrieval	Private data retrieval	N	N
SAM account name changed	SAM account name changed	N	N
Security Principal created	Security principal created	N	N
Security Principal deleted changed	Security principal deleted changed	N	N
Security Principal Display Name changed	Security principal display name changed	N	N
Security Principal Name changed	Security principal name changed	N	N
Security Principal Path changed	Security principal path changed	N	N
Security Principal Sam Name changed	Security principal SAM name changed	N	N
Sensitive DACL changed	Sensitive DACL changed	N	N
Service creation	Service creation	N	N
SID-History changed	SID history changed	N	N
SMB session	SMB session	N	N
SmbFileCopy	SMB file copy	N	N
Task scheduling	Task scheduling	N	N
User Mail changed	User mail changed	N	N
User Manager changed	User manager changed	N	N
User Phone Number changed	User phone number changed	N	N
User Title changed	User title changed	N	N
Wmi execution	WMI execution	N	N

any: Directory service activity

Table: IdentityDirectoryEvents

Account Constrained Delegation SPNs changed: Account constrained delegation SPNs changed

Table: IdentityDirectoryEvents

Account Constrained Delegation State changed: Account constrained delegation state changed

Table: IdentityDirectoryEvents

Account Delegation changed: Account delegation changed

Table: IdentityDirectoryEvents

Account Deleted changed: Account deleted changed

Table: IdentityDirectoryEvents

Account disabled

Table: IdentityDirectoryEvents

Account Disabled changed: Account disabled changed

Table: IdentityDirectoryEvents

Account Display Name changed: Account display name changed

Table: IdentityDirectoryEvents

Account enabled

Table: IdentityDirectoryEvents

Account expired

Table: IdentityDirectoryEvents

Account Expiry Time changed: Account expiry time changed

Table: IdentityDirectoryEvents

Account Name changed: Account name changed

Table: IdentityDirectoryEvents

Account password change failed

Table: IdentityDirectoryEvents

Account Password changed: Account password changed

Table: IdentityDirectoryEvents

Account Password expired: Account password expired

Table: IdentityDirectoryEvents

Account Password Never Expires changed: Account password never expires changed

Table: IdentityDirectoryEvents

Account Password Not Required changed: Account password not required changed

Table: IdentityDirectoryEvents

Account Path changed: Account path changed

Table: IdentityDirectoryEvents

Account primary group ID changed

Table: IdentityDirectoryEvents

Account Smart Card Required changed: Account smart card required changed

Table: IdentityDirectoryEvents

Account Supported Encryption Types changed: Account supported encryption types changed

Table: IdentityDirectoryEvents

Account Unlock changed: Account unlock changed

Table: IdentityDirectoryEvents

Account Upn Name changed: Account UPN name changed

Table: IdentityDirectoryEvents

Active Directory security group created

Table: IdentityDirectoryEvents

ADCS certificate issued

Table: IdentityDirectoryEvents

ADFS DKM property read

Table: IdentityDirectoryEvents

ADFS settings changed

Table: IdentityDirectoryEvents

DES encryption restriction changed

Table: IdentityDirectoryEvents

Device Account Created: Device account created

Table: IdentityDirectoryEvents

Device dNSHostName changed: Device DNS host name changed

Table: IdentityDirectoryEvents

Device Operating System changed: Device operating system changed

Table: IdentityDirectoryEvents

Directory Service replication: Directory service replication

Table: IdentityDirectoryEvents

Domain trusts enumerated

Table: IdentityDirectoryEvents

Entra Connect password writeback failed

Table: IdentityDirectoryEvents

GMSA password read

Table: IdentityDirectoryEvents

Group Membership changed: Group membership changed

Table: IdentityDirectoryEvents

Group Policy display name changed

Table: IdentityDirectoryEvents

Group Policy Object created: Group Policy object created

Table: IdentityDirectoryEvents

Group Policy Object deleted: Group Policy object deleted

Table: IdentityDirectoryEvents

Group Policy settings changed

Table: IdentityDirectoryEvents

Kerberos preauthentication flag changed

Table: IdentityDirectoryEvents

Plaintext password allow status changed

Table: IdentityDirectoryEvents

Potential lateral movement path identified

Table: IdentityDirectoryEvents

PowerShell execution

Table: IdentityDirectoryEvents

Private Data Retrieval: Private data retrieval

Table: IdentityDirectoryEvents

SAM account name changed

Table: IdentityDirectoryEvents

Security Principal created: Security principal created

Table: IdentityDirectoryEvents

Security Principal deleted changed: Security principal deleted changed

Table: IdentityDirectoryEvents

Security Principal Display Name changed: Security principal display name changed

Table: IdentityDirectoryEvents

Security Principal Name changed: Security principal name changed

Table: IdentityDirectoryEvents

Security Principal Path changed: Security principal path changed

Table: IdentityDirectoryEvents

Security Principal Sam Name changed: Security principal SAM name changed

Table: IdentityDirectoryEvents

Sensitive DACL changed

Table: IdentityDirectoryEvents

Service creation

Table: IdentityDirectoryEvents

SID-History changed: SID history changed

Table: IdentityDirectoryEvents

SMB session

Table: IdentityDirectoryEvents

SmbFileCopy: SMB file copy

Table: IdentityDirectoryEvents

Task scheduling

Table: IdentityDirectoryEvents

User Mail changed: User mail changed

Table: IdentityDirectoryEvents

User Manager changed: User manager changed

Table: IdentityDirectoryEvents

User Phone Number changed: User phone number changed

Table: IdentityDirectoryEvents

User Title changed: User title changed

Table: IdentityDirectoryEvents

Wmi execution: WMI execution

Table: IdentityDirectoryEvents

Defender-IdentityDirectoryEvents

any: Directory service activity

Account Constrained Delegation SPNs changed: Account constrained delegation SPNs changed

Account Constrained Delegation State changed: Account constrained delegation state changed

Account Delegation changed: Account delegation changed

Account Deleted changed: Account deleted changed

Account disabled

Account Disabled changed: Account disabled changed

Account Display Name changed: Account display name changed

Account enabled

Account expired

Account Expiry Time changed: Account expiry time changed

Account Name changed: Account name changed

Account password change failed

Account Password changed: Account password changed

Account Password expired: Account password expired

Account Password Never Expires changed: Account password never expires changed

Account Password Not Required changed: Account password not required changed

Account Path changed: Account path changed

Account primary group ID changed

Account Smart Card Required changed: Account smart card required changed

Account Supported Encryption Types changed: Account supported encryption types changed

Account Unlock changed: Account unlock changed

Account Upn Name changed: Account UPN name changed

Active Directory security group created

ADCS certificate issued

ADFS DKM property read

ADFS settings changed

DES encryption restriction changed

Device Account Created: Device account created

Device dNSHostName changed: Device DNS host name changed

Device Operating System changed: Device operating system changed

Directory Service replication: Directory service replication

Domain trusts enumerated

Entra Connect password writeback failed

GMSA password read

Group Membership changed: Group membership changed

Group Policy display name changed

Group Policy Object created: Group Policy object created

Group Policy Object deleted: Group Policy object deleted

Group Policy settings changed

Kerberos preauthentication flag changed

Plaintext password allow status changed

Potential lateral movement path identified

PowerShell execution

Private Data Retrieval: Private data retrieval

SAM account name changed

Security Principal created: Security principal created

Security Principal deleted changed: Security principal deleted changed

Security Principal Display Name changed: Security principal display name changed

Security Principal Name changed: Security principal name changed

Security Principal Path changed: Security principal path changed

Security Principal Sam Name changed: Security principal SAM name changed

Sensitive DACL changed

Service creation

SID-History changed: SID history changed

SMB session

SmbFileCopy: SMB file copy

Task scheduling

User Mail changed: User mail changed

User Manager changed: User manager changed

User Phone Number changed: User phone number changed

User Title changed: User title changed

Wmi execution: WMI execution

References #