4798 Security log · Account Management medium severity high volume

Windows Event ID 4798 — A user's local group membership was enumerated

A process enumerated local group membership of a user. CallerProcessName identifies the enumerating process.

Why event 4798 matters

Reconnaissance. BloodHound and PowerView generate characteristic bursts of 4798 events across many accounts rapidly during domain enumeration. High volume from a single non-SYSTEM process is the key indicator.

How to detect it

Alert: >20 instances from single non-SYSTEM CallerProcessName within 5 min. Alert: CallerProcessName is PowerShell, cmd, or network tools. BloodHound signature: rapid enumeration across many accounts and machines.

Log source
Security
Advanced Audit Policy — enable the 'Account Management' subcategory (Success and/or Failure).
Fields to pivot on
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName

MITRE ATT&CK mapping

Tactic Technique
Discovery Permission Groups Discovery: Local Groups (T1069.001)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule
title: Bulk Local Group Membership Enumeration
status: experimental
description: Rapid local group enumeration typical of BloodHound or PowerView
author: theadminstack.com
date: 2026/05/16
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4798
    filter_system:
        CallerProcessName|startswith: 'C:\\Windows\\System32\\'
    condition: selection and not filter_system | count() by CallerProcessName > 20
falsepositives:
    - Legitimate admin scripts
    - IT asset management tools
level: medium
tags:
    - attack.discovery
    - attack.t1069.001
Sentinel / Defender KQL
SecurityEvent
| where EventID == 4798   // A user's local group membership was enumerated
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Security" EventCode=4798
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# A user's local group membership was enumerated — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
Hunt event 4798 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related Account Management events

4720 A user account was created 4722 A user account was enabled 4723 An attempt was made to change an account's password 4724 An attempt was made to reset an account's password 4725 A user account was disabled 4726 A user account was deleted 4728 A member was added to a security-enabled global group 4729 A member was removed from a security-enabled global group 4730 A security-enabled global group was deleted 4731 A security-enabled local group was created 4732 A member was added to a security-enabled local group 4733 A member was removed from a security-enabled local group

Frequently asked questions

What is Windows Event ID 4798?

A user's local group membership was enumerated. A process enumerated local group membership of a user. CallerProcessName identifies the enumerating process.

Which log records event 4798?

Event 4798 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Account Management' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 4798?

Event 4798 is associated with: Permission Groups Discovery: Local Groups (T1069.001).

How do you detect activity around event 4798?

Alert: >20 instances from single non-SYSTEM CallerProcessName within 5 min. Alert: CallerProcessName is PowerShell, cmd, or network tools. BloodHound signature: rapid enumeration across many accounts and machines.