Windows Security: Suspicious Updates to Domain Group "ESX Admins"

Alerts on domain group management events involving the "ESX Admins" group name, which may grant privileged access.

FreeUnreviewedSigmahighv1

windows-security-suspicious-updates-to-domain-group-esx-admins-47a1658b

title: 'Windows Security: Suspicious Updates to Domain Group "ESX Admins"'
id: c38b479b-7fc7-446d-ab61-ed756a1840f9
status: test
description: This rule flags Windows Security events indicating creation, modification, deletion, or membership changes for a domain group named "ESX Admins." Such activity matters because systems that recognize this group name may grant elevated administrative access, making unauthorized changes a potential privilege escalation path. It relies on Windows Security telemetry for relevant group management event IDs and matches the group name via the keyword "ESX Admins."
references:
  - https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-37085/win_security_exploit_cve_2024_37085_esxi_admins_group.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-07-30
tags:
  - attack.execution
  - cve.2024-37085
  - detection.emerging-threats
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 4727
      - 4728
      - 4731
      - 4737
      - 4754
      - 4755
      - 4756
  keyword_group:
    - ESX Admins
  condition: selection and keyword_group
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 47a1658b-67a4-48e2-8ab1-c10437fc0148
    type: derived

What it detects

This rule flags Windows Security events indicating creation, modification, deletion, or membership changes for a domain group named "ESX Admins." Such activity matters because systems that recognize this group name may grant elevated administrative access, making unauthorized changes a potential privilege escalation path. It relies on Windows Security telemetry for relevant group management event IDs and matches the group name via the keyword "ESX Admins."

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.