A local security group was created on a system.
Attackers create local groups to organise access without using well-known group names, evading detections based on specific group names.
Alert: local group creation by non-admin accounts or service accounts. Monitor GroupName for suspicious naming.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName | Tactic | Technique |
|---|---|
| Persistence | Account Manipulation (T1098) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 4731 // A security-enabled local group was created
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=4731
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# A security-enabled local group was created — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`A security-enabled local group was created. A local security group was created on a system.
Event 4731 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Account Management' subcategory (Success and/or Failure).
Event 4731 is associated with: Account Manipulation (T1098).
Alert: local group creation by non-admin accounts or service accounts. Monitor GroupName for suspicious naming.