Group Enumeration — Detection Telemetry

Collection and providers

Collect supported group enumeration audit or directory-query telemetry, and correlate with process/API records. Group-management change logs alone do not prove read access.

• Windows Security auditing: Policy-dependent account, object, task and logon records on the host that performs the operation.
• Active Directory domain controllers: Directory changes and authentication records; collect from the relevant controllers, not only endpoints.

Configuration

• Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.
• For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.
• Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*.

Synthetic event example

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0099",
  "collector": "illustrative-lab-collector",
  "observation": {
    "actor": "LAB\\analyst",
    "group": "LabReaders",
    "action": "list_members",
    "result_count": 2
  }
}

Visibility and validation

A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.

• Record the lab scope, collector version, effective configuration and expected source fields before testing.
• Use an approved benign action or read-only snapshot appropriate to this type. For destructive, privileged or physical effects, use a reviewed fixture or existing authorized evidence instead of causing the effect.
• Verify the native source record locally and at the collector; compare timestamps, identity, object, action/result and the type-specific fields listed below. Save a redacted real capture separately from the synthetic example.
• Check a normal baseline and collector-loss case. Fixture parsing proves parser behavior only; it does not prove sensor coverage or malicious-behavior detection.

Primary sources

• Microsoft advanced security audit policy
• Microsoft Audit Directory Service Changes
• Microsoft scheduled-task creation event 4698