crowdstrike_cqlTTP

Security Group Created (Microsoft Defender for Identity)

Detects the creation of a new security group in Active Directory as identified by Microsoft Defender for Identity. While often legitimate, this activity may indicate preparation for privilege escalation or unauthorized access management and should be reviewed. Detects the creation of a new security group in Active Directory as identified by Microsoft Defender for Identity. While often legitimate, this activity may indicate preparation for privilege escalation or unauthorized access management and should be reviewed.

MITRE ATT&CK

T1098

persistence

Detection Query

#Vendor="microsoft"
| #event.dataset="defender-identity.IdentityDirectoryEvents"
| event.action = "security group created"
| #event.outcome = success
| table([@timestamp,Vendor.properties.AdditionalFields.TARGET_OBJECT.GROUP,Vendor.properties.DestinationDeviceName])

Author

Kundan Kumar

Data Sources

Identity

Tags

Detectioncs_module:Identity

Raw Content

# --- Query Metadata ---
# Human-readable name for the query. Will be displayed as the title.
name: Security Group Created (Microsoft Defender for Identity)

# MITRE ATT&CK technique IDs
mitre_ids:
  - T1098

# Description of what the query does and its purpose.
description: |
  Detects the creation of a new security group in Active Directory as identified by Microsoft Defender for Identity. While often legitimate, this activity may indicate preparation for privilege escalation or unauthorized access management and should be reviewed.

# The author or team that created the query.
author: Kundan Kumar

# The required log sources to run this query successfully in Next-Gen SIEM.
log_sources:
  - Identity

# The CrowdStrike modules required to run this query.
cs_required_modules:
  - Identity

# Tags for filtering and categorization.
tags:
  - Detection

# --- Query Content ---
# The actual CrowdStrike Query Language (CQL) code.
# Using the YAML block scalar `|` allows for multi-line strings.
cql: |
  #Vendor="microsoft"
  | #event.dataset="defender-identity.IdentityDirectoryEvents"
  | event.action = "security group created"
  | #event.outcome = success
  | table([@timestamp,Vendor.properties.AdditionalFields.TARGET_OBJECT.GROUP,Vendor.properties.DestinationDeviceName])

# Explanation of the query.
# Using the YAML block scalar `|` allows for multi-line strings.
# Uses markdown for formatting on the webpage.
explanation: |
  Detects the creation of a new security group in Active Directory as identified by Microsoft Defender for Identity. While often legitimate, this activity may indicate preparation for privilege escalation or unauthorized access management and should be reviewed.