User added to a local security group (e.g., local Administrators, Remote Desktop Users).
Adding accounts to local Administrators = local admin escalation. Remote Desktop Users = enabling RDP access. Attackers add backdoor accounts to local Administrators for persistent local admin.
Alert: GroupName=Administrators + MemberName is domain account not in IT allowlist. Alert: GroupName=Remote Desktop Users. Critical on DCs — local admin changes on DCs are especially sensitive.
MemberNameTargetUserNameSubjectUserName | Tactic | Technique |
|---|---|
| Privilege Escalation | Valid Accounts: Local Accounts (T1078.003) |
| Persistence | Account Manipulation (T1098) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
title: Member Added to Local Administrators Group
status: stable
description: Account added to local Administrators group
author: theadminstack.com
date: 2026/05/16
logsource:
product: windows
service: security
detection:
selection:
EventID: 4732
TargetUserName: 'Administrators'
condition: selection
falsepositives:
- Legitimate IT provisioning
level: high
tags:
- attack.privilege_escalation
- attack.t1078.003SecurityEvent
| where EventID == 4732 // A member was added to a security-enabled local group
| project TimeGenerated, Computer, MemberName, TargetUserName, SubjectUserName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=4732
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# A member was added to a security-enabled local group — add EventData fields: MemberName, TargetUserName, SubjectUserName`A member was added to a security-enabled local group. User added to a local security group (e.g., local Administrators, Remote Desktop Users).
Event 4732 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Account Management' subcategory (Success and/or Failure).
Event 4732 is associated with: Valid Accounts: Local Accounts (T1078.003), Account Manipulation (T1098).
Alert: GroupName=Administrators + MemberName is domain account not in IT allowlist. Alert: GroupName=Remote Desktop Users. Critical on DCs — local admin changes on DCs are especially sensitive.