Windows Security: Member Removed From a Security-Enabled Global Group

title: "Windows Security: Member Removed From a Security-Enabled Global Group"
id: 7a3dffbb-31a2-4f3f-8bca-beb8892ad30b
related:
  - id: 9cf01b6c-e723-4841-a868-6d7f8245ca6e
    type: obsolete
  - id: 02c39d30-02b5-45d2-b435-8aebfe5a8629
    type: derived
status: stable
description: This rule identifies Windows Security Log events where a user or principal is removed from a security-enabled global group. Removing group membership can reduce access for legitimate users or be used to disrupt monitoring and access control, making it an important change to investigate. It relies on Security log telemetry for Event IDs 633 and 4729 indicating the membership removal action.
references:
  - https://www.cisecurity.org/controls/cis-controls-list/
  - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
  - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4729
  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=633
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_member_removed_security_enabled_global_group.yml
author: Alexandr Yampolskyi, SOC Prime, Huntrule Team
date: 2023-04-26
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1098
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 633
      - 4729
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1