smtp address for the AD group was changed by an admin.Would like to check who made the changes in AD by renaming the AD group or the smtp address.
hello there, i think its being captures in Windows Event Codes 4732 - 4738 read here: https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4738 capture it in splunk and modify your search accordingly
