User added to a universal security group (e.g., Enterprise Admins, universal distribution groups with security).
Universal groups replicate to Global Catalog — changes are forest-wide. Enterprise Admins is a universal group. Additions to Enterprise Admins provide forest-wide admin access.
Alert: GroupName=Enterprise Admins or any universal group with forest-wide privileges. Alert: outside change management windows.
MemberNameTargetUserNameSubjectUserName | Tactic | Technique |
|---|---|
| Persistence | Account Manipulation (T1098) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 4756 // A member was added to a security-enabled universal group
| project TimeGenerated, Computer, MemberName, TargetUserName, SubjectUserName
| sort by TimeGenerated desc
index=* sourcetype="WinEventLog:Security" EventCode=4756
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# A member was added to a security-enabled universal group — add EventData fields: MemberName, TargetUserName, SubjectUserName`
A member was added to a security-enabled universal group. User added to a universal security group (e.g., Enterprise Admins, universal distribution groups with security).
Event 4756 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Account Management' subcategory (Success and/or Failure).
Event 4756 is associated with: Account Manipulation (T1098).
Alert: GroupName=Enterprise Admins or any universal group with forest-wide privileges. Alert: outside change management windows.