Windows Security 4732: New Member Added to Local Administrators Group

title: "Windows Security 4732: New Member Added to Local Administrators Group"
id: 32c56d3f-429f-491f-9f5b-b3ddeb1c92cb
status: stable
description: This rule identifies when a new account is added to the local Administrators group by matching Windows Security Event ID 4732. Such changes can be legitimate administrative actions, but attackers may use them to gain elevated access and maintain persistence. The detection relies on audit telemetry from the Windows Security log, specifically the target account details and the local administrators group SID.
references:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4732
  - https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_user_added_to_local_administrators.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-03-14
modified: 2021-01-17
tags:
  - attack.initial-access
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1078
  - attack.persistence
  - attack.t1098
logsource:
  product: windows
  service: security
detection:
  selection_eid:
    EventID: 4732
  selection_group:
    - TargetUserName|startswith: Administr
    - TargetSid: S-1-5-32-544
  filter_main_computer_accounts:
    SubjectUserName|endswith: $
  condition: all of selection_* and not 1 of filter_*
falsepositives:
  - Legitimate administrative activity
level: medium
license: DRL-1.1
related:
  - id: c265cf08-3f99-46c1-8d59-328247057d57
    type: derived