Possible A Member Was Removed From a Security-Enabled Global Group (via security)

title: Possible A Member Was Removed From a Security-Enabled Global Group (via security)
id: d09e8a1b-157d-5156-aadf-291b9437af26
status: stable
description: This rule detects behavior when a member is removed from a security-enabled global group
references:
    - https://attack.mitre.org/techniques/T1098/
    - https://www.cisecurity.org/controls/cis-controls-list/
    - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
    - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
    - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4729
    - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=633
author: Huntrule Team
date: 2026-05-20
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1098
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID:
            - 633
            - 4729
    condition: selection
falsepositives:
    - Unknown
level: low