Monitoring Active Directory for Signs of Compromise | Microsoft Learn

https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/monitoring-active-directory-for-signs-of-compromise