Active Directory Object Deletion — Detection Telemetry

Collection and providers

Enable Audit Directory Service Changes and relevant SACLs; retain object GUID/DN, actor and deletion time.

• Windows Security auditing: Policy-dependent account, object, task and logon records on the host that performs the operation.
• Active Directory domain controllers: Directory changes and authentication records; collect from the relevant controllers, not only endpoints.

Configuration

• Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.
• For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.
• Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*.

Synthetic event example

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0068",
  "collector": "illustrative-lab-collector",
  "observation": {
    "object_guid": "lab-object-1",
    "object_dn": "CN=LabTemp,OU=Lab,DC=example,DC=test",
    "action": "delete"
  }
}

Visibility and validation

A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.

• Record the lab scope, collector version, effective configuration and expected source fields before testing.
• Use an approved benign action or read-only snapshot appropriate to this type. For destructive, privileged or physical effects, use a reviewed fixture or existing authorized evidence instead of causing the effect.
• Verify the native source record locally and at the collector; compare timestamps, identity, object, action/result and the type-specific fields listed below. Save a redacted real capture separately from the synthetic example.
• Check a normal baseline and collector-loss case. Fixture parsing proves parser behavior only; it does not prove sensor coverage or malicious-behavior detection.

Primary sources

• Microsoft advanced security audit policy
• Microsoft Audit Directory Service Changes
• Microsoft scheduled-task creation event 4698