High risk local/domain local group membership change

Status: experimental
Severity: high
Log source: product windows, service security
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where a suspicious group membership is changed. Having Microsoft LAPS installed may trigger false positive events for the builtin administrators group triggered by the system account (S-1-5-18).

Known false positives

Administrator activity

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1098` Account Manipulation

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4732: A member was added to a security-enabled local group.

Rule body

title: High risk local/domain local group membership change
description: Detects scenarios where a suspicious group membership is changed. Having Microsoft LAPS installed may trigger false positive events for the builtin administrators group triggered by the system account (S-1-5-18).
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1098.xxx-Account%20manipulation
- https://ss64.com/nt/syntax-groups.html
- https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/security-identifiers
tags:
- attack.persistence
- attack.t1098
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4732 # local and domain local group
    TargetSid|startswith: 'S-1-5-32'
    TargetSid|endswith:
      - '-544' # Administrators
      - '-547' # Power Users
      - '-548' # Account Operators
      - '-549' # Server Operators
      - '-551' # Backup Operators
      - '-578' # Hyper-V Administrators
  filter:
    SubjectUserSid: 'S-1-5-18' # LAPS or others IAM solutions may trigger this as a false positive
  condition: selection and not filter
falsepositives:
- Administrator activity
level: high

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
  EventID: 4732
  TargetSid|startswith: 'S-1-5-32'
  TargetSid|endswith:
    - '-544'
    - '-547'
    - '-548'
    - '-549'
    - '-551'
    - '-578'

Stage 2: `not filter`

filter:
  SubjectUserSid: 'S-1-5-18'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`SubjectUserSid`	eq	`S-1-5-18`	`excludes:SubjectUserSid` `field:"SubjectUserSid" value:"S-1-5-18"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetSid`	ends_with	`-544` `-547` `-548` `-549` `-551` `-578`	`field:"TargetSid" kind:ends_with`
`TargetSid`	starts_with	`S-1-5-32` corpus 2 (sigma 2)	`field:"TargetSid" kind:starts_with value:"S-1-5-32"`