Account added to a privileged local or domain group

Siemphony@siemphonymediumT1098.007unverified

AN0865 is the directory's own record of this technique: the six group membership events that Security logging emits when a principal is added to or removed from a security-enabled group. This rule keeps the three additions — 4728 for a global group, 4732 for a local or builtin group, 4756 for a universal group — and drops the matching removals 4729, 4733 and 4757, because removing a member is the cleanup half rather than the persistence, and carrying it would roughly double the volume for events that describe the opposite act. MITRE's `TargetGroup` knob is what the second selection implements, populated here with well-known relative identifiers rather than with group names: the event's `TargetSid` is the group, and matching on the RID suffix (-512 Domain Admins, -519 Enterprise Admins, -518 Schema Admins, -520 Group Policy Creator Owners, -544 the builtin Administrators, -548/-549/-550/-551 the operator groups, -555 Remote Desktop Users, -580 Remote Management Users) survives a localised Windows install and a renamed group, both of which defeat a list of names. The technique description calls out Remote Desktop Users and the administrators group specifically, and the operator groups are included because each is a documented route back to domain admin. The RID suffixes cannot collide with a custom group: RIDs for new objects begin at 1000, so a value such as 2544 does not end in `-544`. Limits and prerequisite. What this cannot see is the group that matters most in many estates — a delegated helpdesk or application group with a site-specific RID, or DnsAdmins, which has no well-known RID. Adding those RIDs or switching the selection to `TargetUserName` is the first tuning step. MITRE's `TimeWindow` and `UserContext` knobs — fire only outside a change window, or only when the modifying account is not a known provisioning identity — are a schedule and a per-identity baseline, and lib/sigma models neither, so nothing here encodes them; the event does carry `SubjectUserName` and `MemberName`, which is where that filtering belongs once the site knows its own provisioning accounts. The Linux and macOS arms AN0866 and AN0867 are not attempted here: they are a different log source with a different vocabulary and belong in their own rule. Prerequisite: these events require *Audit Security Group Management* (Success), which unlike Process Creation auditing is on by default on current Windows client and server builds, so the events are usually being written. The gap is collection, not policy: 4728 and 4756 are written on the domain controller that serviced the change, so all DCs must be forwarded or the change is simply missed, and 4732 for a local Administrators addition — the single most common form of this technique — is written only in the Security log of the member server or workstation it happened on, which many estates do not ship at all. Where a hardening baseline or a legacy policy has turned the subcategory off, this returns zero rows, and zero rows there reads as quiet when it means blind; confirm with `auditpol /get /subcategory:"Security Group Management"` rather than assuming either way. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0310, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

SecurityEvent| where ((EventID == 4728 or EventID == 4732 or EventID == 4756) and (TargetSid endswith "-512" or TargetSid endswith "-518" or TargetSid endswith "-519" or TargetSid endswith "-520" or TargetSid endswith "-544" or TargetSid endswith "-548" or TargetSid endswith "-549" or TargetSid endswith "-550" or TargetSid endswith "-551" or TargetSid endswith "-555" or TargetSid endswith "-580"))

Splunk · SPL

Run this as a search.

index=* ((EventID="4728" OR EventID="4732" OR EventID="4756") AND (TargetSid="*-512" OR TargetSid="*-518" OR TargetSid="*-519" OR TargetSid="*-520" OR TargetSid="*-544" OR TargetSid="*-548" OR TargetSid="*-549" OR TargetSid="*-550" OR TargetSid="*-551" OR TargetSid="*-555" OR TargetSid="*-580"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((event.code == 4728 OR event.code == 4732 OR event.code == 4756) AND (TO_LOWER(TargetSid) LIKE "*-512" OR TO_LOWER(TargetSid) LIKE "*-518" OR TO_LOWER(TargetSid) LIKE "*-519" OR TO_LOWER(TargetSid) LIKE "*-520" OR TO_LOWER(TargetSid) LIKE "*-544" OR TO_LOWER(TargetSid) LIKE "*-548" OR TO_LOWER(TargetSid) LIKE "*-549" OR TO_LOWER(TargetSid) LIKE "*-550" OR TO_LOWER(TargetSid) LIKE "*-551" OR TO_LOWER(TargetSid) LIKE "*-555" OR TO_LOWER(TargetSid) LIKE "*-580"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="EventID" type="pcre2">(?i)(^4728$|^4732$|^4756$)</field>    <field name="TargetSid" type="pcre2">(?i)(-512$|-518$|-519$|-520$|-544$|-548$|-549$|-550$|-551$|-555$|-580$)</field>    <description>Account added to a privileged local or domain group</description>    <mitre>      <id>T1098.007</id>    </mitre>  </rule></group>

At a glance

Logsource: security / windows
Level: medium
Category: account_manipulation
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: cb61e4d7-bf63-4bdf-b6ae-cc166cd01bc0

ATT&CKT1098.007

T1098.007Additional Local or Domain Groups

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonaccount manipulation

account manipulationAI draft — unreviewed

01 · What this rule detects

An account being added to a privileged Windows group. AN0865 is the directory's own record of the technique: the six group-membership events Security logging emits when a principal is added to or removed from a security-enabled group. This rule keeps the three additions and drops the three removals: removal is the cleanup half rather than the persistence, and carrying it would roughly double the volume for events describing the opposite act. The Linux and macOS arms, AN0866 and AN0867, are not attempted — different sources, different vocabulary, their own rule.

02 · Telemetry you need

windows / security. The subcategory is Audit Security Group Management (Success), which — unlike Process Creation auditing — is on by default on current client, server and DC builds, so the events are usually being written. The gap is collection, not policy. 4728 and 4756 are written on the domain controller that serviced the change, so every DC must be forwarded or the change is simply missed; 4732 for a local Administrators addition, the single most common form of this technique, is written only in the Security log of the member server or workstation it happened on, which many estates never ship. Confirm with auditpol /get /subcategory:"Security Group Management" rather than assuming — where a hardening baseline turned it off, zero rows read as quiet when they mean blind. The rule also needs the raw SID string to survive ingestion: a pipeline that resolves SIDs to display names before indexing needs the selection switched to TargetUserName and a localisation-aware list.

03 · How the logic works

Two selections, AND-ed. selection_member_added matches EventID 4728 (global group), 4732 (local or builtin) and 4756 (universal). selection_privileged_group matches TargetSid|endswith against well-known relative identifiers: -512 Domain Admins, -518 Schema Admins, -519 Enterprise Admins, -520 Group Policy Creator Owners, -544 builtin Administrators, -548/-549/-550/-551 the operator groups, -555 Remote Desktop Users, -580 Remote Management Users. This is MITRE's TargetGroup knob, populated here with RIDs chosen by the pipeline rather than with a list MITRE supplied. Matching the RID suffix rather than a group name survives a localised install and a renamed group, both of which defeat a name list. The suffixes cannot collide with custom groups: RIDs for new objects begin at 1000 and the endswith term includes the leading hyphen, so 2544 does not match -544. MITRE's TimeWindow and UserContext knobs — fire only outside a change window, or only when the modifying account is not a known provisioning identity — are a schedule and a per-identity baseline, neither of which lib/sigma models; the events carry SubjectUserName and MemberName, which is where that filtering belongs downstream.

04 · Common false positives

Joiner-mover-leaver workflows, IGA connectors and self-service access tools add accounts to Remote Desktop Users and delegated admin groups continuously and in bulk — by a wide margin the highest-volume match. Backup, monitoring and database installers add their service account to local Administrators or Backup Operators as a documented setup step. Imaging and domain-join scripts add the support group to local Administrators on every machine they touch. And routine directory administration inside a change window is indistinguishable in the log from the adversary's version.

05 · Detection maturity

tier_1: Lowest tier. Machine-derived from MITRE ATT&CK v19.2 and never run against a log line — no true positive, no false positive, no measured volume. It advances only once you confirm member-server Security logs reach your platform, check that SIDs arrive unresolved, run it over history, and add an account to a test group to watch it fire.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

The single medium level averages a near-certain incident with routine provisioning, and is wrong for both. Split it: -512/-518/-519/-520/-544 and the operator RIDs deserve their own rule at high or critical, with -555 and -580 left low. The more important tuning step is coverage, not volume. Nesting defeats the RID list outright — adding the controlled account to an unremarkable custom group that is already a member of Domain Admins produces a 4728 whose TargetSid ends in a RID above 1000 and never matches. Enumerate your own tier-0 group SIDs, including groups nested into the well-known ones and AdminSDHolder-protected groups without well-known RIDs such as DnsAdmins, and add them explicitly.

Declared by the author

Identity provisioning and access-request automation. Joiner-mover-leaver workflows, IGA connectors and self-service access tools add accounts to Remote Desktop Users and to delegated administrator groups continuously and in bulk, so in any organisation with automated provisioning this is by far the highest-volume match and the reason the rule is medium rather than high.
Server and application installers that grant their service account rights during setup. Backup, monitoring and database products add the account they run as to the local Administrators or Backup Operators group as a documented install step, producing one match per host during a rollout.
Endpoint build and imaging. Domain join scripts, golden-image provisioning and lab rebuilds add the support or engineering group to local Administrators on every machine they touch, so a hardware refresh or an OS upgrade wave emits a burst of 4732 events with nobody at the keyboard.
Routine directory administration inside a change window. Adding a new administrator to Domain Admins or nesting a role group under an operator group is ordinary work for the identity team, and the event is indistinguishable from the adversary's apart from the account that performed it and the ticket behind it.

Noise check0 of 6 fired

Fires on none of the 6 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 6 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1098.007, evaluated against their — events.

Share this rule

/u/siemphony/cb61e4d7-bf63-4bdf-b6ae-cc166cd01bc0

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Account added to a privileged local or domain group

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it