Windows Event ID 4764 — A group's type was changed

A group was changed between distribution and security, or between local/global/universal scope.

Why event 4764 matters

Converting distribution groups to security groups can grant unexpected access. Changing scope to universal makes membership forest-wide. Attackers may change group type to extend the reach of compromised group memberships.

How to detect it

Alert: any group type or scope change involving previously non-security groups. Alert: conversion of distribution to security groups for privileged distribution lists.

MITRE ATT&CK mapping

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

SecurityEvent
| where EventID == 4764   // A group's type was changed
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc

index=* sourcetype="WinEventLog:Security" EventCode=4764
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# A group's type was changed — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`

Related Account Management events