detection.wiki

Microsoft-Windows-Security-Auditing › Event 4732

Event ID 4732 — A member was added to a security-enabled local group.

Provider
Microsoft-Windows-Security-Auditing
Channel
Security
Audit Policy
Account Management → Security Group Management
Collection Priority
Recommended (Palantir, others)
Opcode
Info

Description

A member was added to a security-enabled local group.

Message #

A member was added to a security-enabled local group.

Subject:
	Security ID: %6
	Account Name: %7
	Account Domain: %8
	Logon ID: %9

Member:
	Security ID: %2
	Account Name: %1

Group:
	Security ID: %5
	Group Name: %3
	Group Domain: %4

Additional Information:
	Privileges: %10

Fields #

NameDescription
MemberName UnicodeString[Member] Account Name.
MemberSid SID[Member] Security ID.
TargetUserName UnicodeString[Group] Group Name.
TargetDomainName UnicodeString[Group] Group Domain.
TargetSid SID[Group] Security ID.
SubjectUserSid SID[Subject] Security ID.
SubjectUserName UnicodeString[Subject] Account Name.
SubjectDomainName UnicodeString[Subject] Account Domain.
SubjectLogonId HexInt64[Subject] Logon ID.
PrivilegeList UnicodeString[Additional Information] Privileges. Privilege constants reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-Auditing",
    "guid": "54849625-5478-4994-A5BA-3E3B0328C30D",
    "event_source_name": "",
    "event_id": 4732,
    "version": 0,
    "level": 0,
    "task": 13826,
    "opcode": 0,
    "keywords": 9232379236109516800,
    "time_created": "2023-11-06T06:25:35.063652+00:00",
    "event_record_id": 2788,
    "correlation": {
      "ActivityID": "F590C418-1079-0001-5BC5-90F57910DA01"
    },
    "execution": {
      "process_id": 808,
      "thread_id": 896
    },
    "channel": "Security",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "MemberName": "-",
    "MemberSid": "S-1-5-21-1992711665-1655669231-58201500-1000",
    "TargetUserName": "Administrators",
    "TargetDomainName": "Builtin",
    "TargetSid": "S-1-5-32-544",
    "SubjectUserSid": "S-1-5-18",
    "SubjectUserName": "WINDEV2310EVAL$",
    "SubjectDomainName": "WORKGROUP",
    "SubjectLogonId": "0x3e7",
    "PrivilegeList": "-"
  },
  "message": ""
}

Detection Patterns #

Detection Rules #

View all rules referencing this event →

Sigma # view in reference

Splunk # view in reference

  • Windows DnsAdmins New Member Added source: The following analytic detects the addition of a new member to the DnsAdmins group in Active Directory by leveraging Event ID 4732. This detection uses security event logs to identify changes to this high-privilege group. Monitoring this activity is crucial because members of the DnsAdmins group can manage the DNS service, often running on Domain Controllers, and potentially execute malicious code with SYSTEM privileges. If confirmed malicious, this activity could allow an attacker to escalate privileges and gain control over critical domain services, posing a significant security risk.

References #