New User Added to a Privileged Local Group

Detects a new member being added to a security-enabled local group (EventID 4732), which covers the common post-compromise persistence step of adding an attacker-controlled or newly created account to the local Administrators group.

T1098 T1136.001 T1078

Detection logic

{
  "detection_type": "selection",
  "selection": {
    "EventID": 4732
  }
}

Log source: product=windows, service=security · Event ID(s): 4732

Required log fields

SubjectUserName
SubjectUserSid
TargetUserName
MemberName
MemberSid
GroupName

Enabling this in your environment

Where: Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Account Management > Audit Security Group Management

auditpol /set /subcategory:"Security Group Management" /success:enable /failure:enable

Disabled by default on older baselines - explicitly enable it. Pair with WIN-1004 (4720, new account creation) to catch "create account then add to admins" attack chains end to end.

False positives

Legitimate IT/helpdesk group membership changes - correlate with your change ticket source

References

https://attack.mitre.org/techniques/T1098/