ADTimeline

Active Directory is a prime target in mostly all cyberattacks, and attackers often attempt to gain Domain Admin privileges and maintain their access. That is why it is crucial for security teams to monitor the changes occurring on Active Directory. Active Directory modifications are recorded in the Domain Controllers Windows event logs but its scope/completeness depends on the auditing strategy configured. Unfortunately, those events are too rarely centralized, analyzed and archived. As a consequence, replication metadata is sometimes the only artefact left for DFIR analyst to characterize changes made on the Active Directory. The ADTimeline application for splunk processes and analyses the Active Directory data collected by the ADTimeline PowerShell script. The ADTimeline PowerShell script generates a timeline of Active Directory changes based on replication metadata and is available on github.