Security Group Created (Microsoft Defender for Identity)
Detects the creation of a new security group in Active Directory as identified by Microsoft Defender for Identity. While often legitimate, this activity may indicate preparation for privilege escalation or unauthorized access management and should be reviewed.
CQL · Falcon Next-Gen SIEMCopy query
#Vendor="microsoft"
| #event.dataset="defender-identity.IdentityDirectoryEvents"
| event.action = "security group created"
| #event.outcome = success
| table([@timestamp,Vendor.properties.AdditionalFields.TARGET_OBJECT.GROUP,Vendor.properties.DestinationDeviceName])Detects the creation of a new security group in Active Directory as identified by Microsoft Defender for Identity. While often legitimate, this activity may indicate preparation for privilege escalation or unauthorized access management and should be reviewed.
security_group_created_microsoft_defender_for_identity.yml
T1098
Kundan Kumar
Detection
Identity
Identity
2026-05-21
2026-05-21
