Sigma rule: Group Modification Logging

Rule

Title

Group Modification Logging

Status

deprecated

Level

low

Author

Alexandr Yampolskyi, SOC Prime

Date

2019/03/26

Modified

2023/04/26

File

deprecated/windows/win_security_group_modification_logging.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Configure systems to issue a log entry and alert when an account is added to or removed from any group assigned administrative privileges.
Sigma detects
Event ID 4728 indicates a "Member is added to a Security Group".
Event ID 4729 indicates a "Member is removed from a Security enabled-group".
Event ID 4730 indicates a "Security Group is deleted".
The case is not applicable for Unix OS.
Supported OS - Windows 2008 R2 and 7, Windows 2012 R2 and 8.1, Windows 2016 and 10 Windows Server 2019, Windows Server 2000, Windows 2003 and XP.

Log source

product

windows

service

security

Detection

selection:
    EventID:
        - 4728 # A member was added to a security-enabled global group
        - 4729 # A member was removed from a security-enabled global group
        - 4730 # A security-enabled global group was deleted
        - 633 # Security Enabled Global Group Member Removed
        - 632 # Security Enabled Global Group Member Added
        - 634 # Security Enabled Global Group Deleted
condition: selection

False positives (as the rule lists them)

• Unknown

References

• https://www.cisecurity.org/controls/cis-controls-list/
• https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
• https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
• https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4728
• https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4729
• https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4730
• https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=633
• https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=632
• https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=634

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/deprecated/windows/win_security_group_modification_logging.yml