sigmalowTTP

A Member Was Added to a Security-Enabled Global Group

Detects activity when a member is added to a security-enabled global group

MITRE ATT&CK

privilege-escalationpersistence

Detection Query

selection:
  EventID:
    - 4728
    - 632
condition: selection

Author

Alexandr Yampolskyi, SOC Prime

Created

2023-04-26

Data Sources

windowssecurity

Platforms

windows

References

Tags

attack.privilege-escalationattack.persistenceattack.t1098

Raw Content

title: A Member Was Added to a Security-Enabled Global Group
id: c43c26be-2e87-46c7-8661-284588c5a53e
related:
    - id: 9cf01b6c-e723-4841-a868-6d7f8245ca6e
      type: obsolete
status: stable
description: Detects activity when a member is added to a security-enabled global group
references:
    - https://www.cisecurity.org/controls/cis-controls-list/
    - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
    - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
    - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4728
    - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=632
author: Alexandr Yampolskyi, SOC Prime
date: 2023-04-26
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1098
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID:
            - 4728 # A member was added to a security-enabled global group
            - 632 # Security Enabled Global Group Member Added
    condition: selection
falsepositives:
    - Unknown
level: low