Windows Security: Member Added to Security-Enabled Global Group

Alerts when Windows logs show a user was added to a security-enabled global group via Event ID 4728 or 632.

FreeReviewedSigma · Low · v2

Product: windows
Service: security
Author: Alexandr Yampolskyi, SOC Prime (SigmaHQ), DRL 1.1
Published: 2023-04-26
Updated: 2026-07-31

ATT&CK techniques

Persistence → Priv Esc

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1098Account Manipulation
Priv Esc
- T1098Account Manipulation
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows Security log events indicating a new member was added to a security-enabled global group. Such changes can grant access to resources and are a common step in privilege escalation or persistence. It relies on the presence of Security events 4728 and 632 and matches them directly by EventID.

Reporting behind it

Related detections9 linkedT1098 — drag to rearrange

Malicious Domain and Enterprise Admins Group Addition via net group Domain Add (via process_creation)

Suspicious Route53 Domain Transfer Lock Disabled via Scattered Spider Technique

Suspicious Domain Admin Account Creation via net (via process_creation)

Suspicious Guest Account Privilege Escalation (via process_creation)

Suspicious Login Shell Assigned to Service Account games on Linux

Suspicious dMSA Object Access with Migration AccessMask

Windows HackTool Execution: GoldenDMSA.exe Launch with Directory Manipulation Parameters

Suspicious Compute Instance Metadata Modification in GCP

Suspicious Azure AD Authentication Method Registration for Account Takeover (via azure)

Windows Security: Member Added to Security-Enabled Global Group

Pivot detection · T1098 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-security-log-member-added-to-security-enabled-global-group-4728-632-c43c26be

title: "Windows Security: Member Added to Security-Enabled Global Group"
id: 6fcf51b3-4255-4070-afcc-7c3d004740f5
related:
  - id: 9cf01b6c-e723-4841-a868-6d7f8245ca6e
    type: obsolete
  - id: c43c26be-2e87-46c7-8661-284588c5a53e
    type: derived
status: stable
description: This rule flags Windows Security log events indicating a new member was added to a security-enabled global group. Such changes can grant access to resources and are a common step in privilege escalation or persistence. It relies on the presence of Security events 4728 and 632 and matches them directly by EventID.
references:
  - https://www.cisecurity.org/controls/cis-controls-list/
  - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
  - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4728
  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=632
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_member_added_security_enabled_global_group.yml
author: Alexandr Yampolskyi, SOC Prime, Huntrule Team
date: 2023-04-26
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1098
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 4728
      - 632
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL