AD Privileged Users or Groups Reconnaissance — Detection Rule
Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs
Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs