Windows Security Logs: Security-Enabled Global Group Deletion (Event ID 4730/634)

title: "Windows Security Logs: Security-Enabled Global Group Deletion (Event ID 4730/634)"
id: b034151d-cb48-43c3-83eb-3b79e00d3f89
related:
  - id: 9cf01b6c-e723-4841-a868-6d7f8245ca6e
    type: obsolete
  - id: b237c54b-0f15-4612-a819-44b735e0de27
    type: derived
status: stable
description: This rule flags deletion of a security-enabled global group in Windows, based on Security log events 4730 and 634. Removing global groups can disrupt access controls or be used to weaken permissions and reduce visibility while attackers maintain persistence. It relies on Windows Security audit telemetry that records these group deletion events.
references:
  - https://www.cisecurity.org/controls/cis-controls-list/
  - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
  - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4730
  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=634
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_security_enabled_global_group_deleted.yml
author: Alexandr Yampolskyi, SOC Prime, Huntrule Team
date: 2023-04-26
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1098
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 4730
      - 634
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1