Detection rules › Kusto Query Language

Local Admin Group Changes

Source
upstream

This query searches for changes to the local administrators group. Blogpost: https://www.verboon.info/2020/09/hunting-for-local-group-membership-changes.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1098 Account Manipulation
Privilege EscalationT1098 Account Manipulation

Event coverage

ProviderEvent IDTitle
Security-Auditing4732A member was added to a security-enabled local group.
Defender-DeviceEvents9007007User account added to local group

Stages and Predicates

Stage 1: source

DeviceEvents

Stage 2: where

ActionType eq "UserAccountAddedToLocalGroup"

Stage 3: where

and
  not
    AccountSid eq "machineAccountSIDs"
  AccountSid regex_match "S-\\d-\\d+-\\d+-(\\d+-){1,5}\\d+"

Stage 4: extend

Stage 5: extend

Stage 6: extend

Stage 7: extend

Stage 8: join

Stage 9: project

Stage 10: join

Stage 11: extend

Stage 12: extend

Stage 13: project

Stage 14: where

not
  DeviceName contains "Actor"

Stage 15: extend

Stage 16: extend

Exclusions

Top-level NOT(...) conjuncts — predicates this rule actively suppresses.

StageFieldKindExcluded values
1SubjectUserSideqmachineAccountSIDs
1ComputercontainsActor

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
AccountSidregex_match
  • S-\d-\d+-\d+-(\d+-){1,5}\d+
ActionTypeeq
  • UserAccountAddedToLocalGroup