DC0068 Active Directory Object Deletion
| Item | Value |
|---|---|
| ID | DC0068 |
| Version | 2.0 |
| Created | 20 October 2021 |
| Last Modified | 12 November 2025 |
Log Sources
| Name | Channel |
|---|---|
| WinEventLog:Security | EventCode=4929 |
Detection Strategy
| ID | Name | Technique Detected |
|---|---|---|
| DET0594 | Detection of Unauthorized DCSync Operations via Replication API Abuse | T1003.006 |