User Account added to Built in Sensitive or Privileged Domain Local or Global Group

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

---

User account was added to a privileged built in domain local group or global group such as the Enterprise Adminis, Cert Publishers or DnsAdmins Be sure to verify this is an expected addition.

Attribute	Value
Type	Hunting Query
Solution	Windows Security Events
ID	8d69a665-074a-443b-aae6-5dd9bdd5cfb1
Tactics	Persistence, PrivilegeEscalation
Techniques	T1098, T1078
Required Connectors	SecurityEvents, WindowsSecurityEvents
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Selection Criteria	Transformations	Ingestion API	Lake-Only
SecurityEvent	EventID in "4728,4732,4756"	✓	✓	?

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Hunting Queries · Back to Windows Security Events