Check out WatchAD2.0 by Qihoo360

[K4ack2013]

Strengthen the log detection of domain control, and recommend you a https://github.com/Qihoo360/WatchAD2.0 item
There are domain-related attack detections here, and I hope the next version of the tool will be updated.

Shortcoming:
Currently, the tool cannot detect common domain attack tools such as mimikatz and Impacket, including log detection of common domain control attacks.

[YamatoSecurity]

Thank you for sharing. Currently Hayabusa does detect all of the attacks mentioned here: https://github.com/Qihoo360/WatchAD2.0/blob/master/README_EN.md#iii-currently-supported-specific-detection-functions
But of course the proper logging has to be turned on. If you want to share any specific .evtx files with us, we can write rules to detect them. We will look into if we can incorporate any methods in WatchAD into Hayabusa.