Windows Security Log: Member Added to Security-Enabled Global Group (4728/632)

title: "Windows Security Log: Member Added to Security-Enabled Global Group (4728/632)"
id: 6fcf51b3-4255-4070-afcc-7c3d004740f5
related:
  - id: 9cf01b6c-e723-4841-a868-6d7f8245ca6e
    type: obsolete
  - id: c43c26be-2e87-46c7-8661-284588c5a53e
    type: derived
status: stable
description: This rule flags Windows Security Log events where an account is added as a member to a security-enabled global group. Such changes can expand access and are a common step in privilege escalation or persistence by granting new permissions through group membership. It relies on telemetry from Windows Security auditing that records Event ID 4728 and 632 for this specific group membership modification.
references:
  - https://www.cisecurity.org/controls/cis-controls-list/
  - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
  - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4728
  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=632
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_member_added_security_enabled_global_group.yml
author: Alexandr Yampolskyi, SOC Prime, Huntrule Team
date: 2023-04-26
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1098
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 4728
      - 632
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1