User added to a global security group. MemberName=who was added, GroupName=the group. Covers domain groups like Domain Admins, Enterprise Admins.
Adding backdoor accounts to Domain Admins, Enterprise Admins, Schema Admins is a primary persistence technique. Tools: net group 'Domain Admins' /add, Add-ADGroupMember.
Alert immediately: GroupName in (Domain Admins, Enterprise Admins, Schema Admins, Group Policy Creator Owners, Protected Users). Alert: additions outside business hours or by non-expected admin accounts.
MemberNameTargetUserNameSubjectUserName | Tactic | Technique |
|---|---|
| Persistence | Account Manipulation (T1098) |
| Privilege Escalation | Valid Accounts: Domain Accounts (T1078.002) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
title: Member Added to High-Privilege Global Group
status: stable
description: Detects additions to sensitive global security groups
author: theadminstack.com
date: 2026/05/16
logsource:
product: windows
service: security
detection:
selection:
EventID: 4728
TargetUserName|contains:
- 'Admin'
- 'Schema'
- 'Enterprise'
condition: selection
falsepositives:
- Legitimate admin provisioning — verify with change management
level: high
tags:
- attack.persistence
- attack.t1098SecurityEvent
| where EventID == 4728 // A member was added to a security-enabled global group
| project TimeGenerated, Computer, MemberName, TargetUserName, SubjectUserName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=4728
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# A member was added to a security-enabled global group — add EventData fields: MemberName, TargetUserName, SubjectUserName`A member was added to a security-enabled global group. User added to a global security group. MemberName=who was added, GroupName=the group. Covers domain groups like Domain Admins, Enterprise Admins.
Event 4728 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Account Management' subcategory (Success and/or Failure).
Event 4728 is associated with: Account Manipulation (T1098), Valid Accounts: Domain Accounts (T1078.002).
Alert immediately: GroupName in (Domain Admins, Enterprise Admins, Schema Admins, Group Policy Creator Owners, Protected Users). Alert: additions outside business hours or by non-expected admin accounts.