A process enumerated membership of a local security group. GroupName and CallerProcessName are key.
Same context as 4798. GroupName=Administrators queries are particularly high signal. BloodHound generates large numbers of these during domain enumeration.
Alert: GroupName=Administrators enumerated by PowerShell or unexpected processes. Combine with 4798 for full enumeration picture.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName | Tactic | Technique |
|---|---|
| Discovery | Permission Groups Discovery: Local Groups (T1069.001) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 4799 // A security-enabled local group membership was enumerated
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
index=* sourcetype="WinEventLog:Security" EventCode=4799
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# A security-enabled local group membership was enumerated — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
A security-enabled local group membership was enumerated. A process enumerated membership of a local security group. GroupName and CallerProcessName are key.
Event 4799 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Account Management' subcategory (Success and/or Failure).
Event 4799 is associated with: Permission Groups Discovery: Local Groups (T1069.001).
Alert: GroupName=Administrators enumerated by PowerShell or unexpected processes. Combine with 4798 for full enumeration picture.