A Member Was Removed From a Security-Enabled Global Group

calendar Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098  ·
Share on: linkedin copy

Detects activity when a member is removed from a security-enabled global group

Sigma rule (View on GitHub)

 1title: A Member Was Removed From a Security-Enabled Global Group
 2id: 02c39d30-02b5-45d2-b435-8aebfe5a8629
 3related:
 4    - id: 9cf01b6c-e723-4841-a868-6d7f8245ca6e
 5      type: obsolete
 6status: stable
 7description: Detects activity when a member is removed from a security-enabled global group
 8references:
 9    - https://www.cisecurity.org/controls/cis-controls-list/
10    - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
11    - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
12    - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4729
13    - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=633
14author: Alexandr Yampolskyi, SOC Prime
15date: 2023-04-26
16tags:
17    - attack.privilege-escalation
18    - attack.persistence
19    - attack.t1098
20logsource:
21    product: windows
22    service: security
23detection:
24    selection:
25        EventID:
26            - 633 # Security Enabled Global Group Member Removed
27            - 4729 # A member was removed from a security-enabled global group
28    condition: selection
29falsepositives:
30    - Unknown
31level: low

References

Related rules

to-top