THE QUIET PHASE: WHY ACTIVE DIRECTORY GROUP ENUMERATION DESERVES YOUR ATTENTION

Summary from the TLDR InfoSec newsletter

Attackers map who sits in Domain Admins with SharpHound or PowerView long before they change any group membership, and an audit entry (SACL) on the group's member attribute turns those reads into Event 4662, or 4799 for built-in groups, on the domain controller that answered. On real privileged groups, the signal drowns in reads from directory sync, Exchange, and admin tooling, and SAMR-based tools like net group /domain bypass it entirely. Pair the audit with decoy groups that nothing legitimate ever reads, correlate a decoy read and a real admin-group read from the same logon session, and check coverage with its QuietPhase PowerShell script.