Account added and removed from privileged groups

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

---

Identifies accounts that are added to a privileged group and then quickly removed, which could be a sign of compromise.

Attribute	Value
Type	Analytic Rule
Solution	Standalone Content
ID	7efc75ce-e2a4-400f-a8b1-283d3b0f2c60
Severity	Low
Kind	Scheduled
Tactics	Persistence, PrivilegeEscalation
Techniques	T1098, T1078
Required Connectors	SecurityEvents, WindowsSecurityEvents, WindowsForwardedEvents
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
SecurityEvent	✓	✓	?
WindowsEvent	✓	✓	?

Associated Connectors

The following connectors provide data for this content item:

Connector	Solution
ESI-Opt34DomainControllersSecurityEventLogs	Microsoft Exchange Security - Exchange On-Premises
SecurityEvents	Windows Security Events
WindowsForwardedEvents	Windows Forwarded Events
WindowsSecurityEvents	Windows Security Events

Solutions: Microsoft Exchange Security - Exchange On-Premises, Windows Forwarded Events, Windows Security Events

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Analytic Rules