Local group membership change

Status: experimental
Severity: high
Log source: category ['ps_module', 'ps_classic_script', 'ps_script'], product windows
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects if a member is added to a local group via PowerShell.

Known false positives

Pentest
Administrator activity
Splunk UF agent installation

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1098` Account Manipulation

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).
PowerShell	Event ID 800

Rule body

title: Local group membership change
description: Detects if a member is added to a local group via PowerShell.
references:
- 
tags:
- attack.persistence
- attack.t1098 # account manipulation
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category:
    - ps_module
    - ps_classic_script
    - ps_script
detection: # Add-LocalGroupMember -Group "Administrators" -Member "Admin02",
  selection1_powershell_native:
    EventID: 800
    EventData|contains|all:
      - 'Add-LocalGroupMember'
      - '-Group'
      - '-Member'

  selection2_powershell_modern:
    EventID: 4103
      - 'Add-LocalGroupMember'
      - '-Group'
      - '-Member'
  
  selection3_powershell_block:
    EventID: 4104
    ScriptBlockText|contains|all:
      - 'Add-LocalGroupMember'
      - '-Group'
      - '-Member'

  condition: 1 of selection*
falsepositives:
- Pentest
- Administrator activity
- Splunk UF agent installation
level: high

Stages and Predicates

Stage 0: `condition`

1 of selection*

Stage 1: `selection1_powershell_native`

selection1_powershell_native:
  EventID: 800
  EventData|contains|all:
    - 'Add-LocalGroupMember'
    - '-Group'
    - '-Member'

Stage 2: `selection2_powershell_modern`

selection2_powershell_modern:
  EventID: 4103
    - 'Add-LocalGroupMember'
    - '-Group'
    - '-Member'

Stage 3: `selection3_powershell_block`

selection3_powershell_block:
  EventID: 4104
  ScriptBlockText|contains|all:
    - 'Add-LocalGroupMember'
    - '-Group'
    - '-Member'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventData`	match	`-Group` `-Member` `Add-LocalGroupMember`	`field:"EventData" kind:match`
`ScriptBlockText`	match	`-Group` `-Member` `Add-LocalGroupMember`	`field:"ScriptBlockText" kind:match`

Local group membership change

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection1_powershell_native

Stage 2: selection2_powershell_modern

Stage 3: selection3_powershell_block

Indicators

Stage 0: `condition`

Stage 1: `selection1_powershell_native`

Stage 2: `selection2_powershell_modern`

Stage 3: `selection3_powershell_block`