A Security-Enabled Global Group Was Deleted

calendar Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098  ·
Share on: linkedin copy

Detects activity when a security-enabled global group is deleted

Sigma rule (View on GitHub)

 1title: A Security-Enabled Global Group Was Deleted
 2id: b237c54b-0f15-4612-a819-44b735e0de27
 3related:
 4    - id: 9cf01b6c-e723-4841-a868-6d7f8245ca6e
 5      type: obsolete
 6status: stable
 7description: Detects activity when a security-enabled global group is deleted
 8references:
 9    - https://www.cisecurity.org/controls/cis-controls-list/
10    - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
11    - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
12    - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4730
13    - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=634
14author: Alexandr Yampolskyi, SOC Prime
15date: 2023-04-26
16tags:
17    - attack.privilege-escalation
18    - attack.persistence
19    - attack.t1098
20logsource:
21    product: windows
22    service: security
23detection:
24    selection:
25        EventID:
26            - 4730 # A security-enabled global group was deleted
27            - 634 # Security Enabled Global Group Deleted
28    condition: selection
29falsepositives:
30    - Unknown
31level: low

References

  • The 18 CIS Controls

    The CIS Critical Security Controls organize your efforts of strengthening your enterprise's cybersecurity posture. Get to know the Controls today!


    Read More

  • Document Library

    A global forum that brings together payments industry stakeholders to develop and drive adoption of data security standards and resources for safe payments.


    Read More

  • %PDF-1.6 %âãÏÓ 3102 0 obj endobj 3108 0 obj /Filter/FlateDecode/ID[ ]/Index[3102 17]/Info 3101 0 R/Length 51/Prev 1061976/Root 3103 0 R/Size 3119/Type/XRef/W[1 2 1]>>stream hÞbbd``b`~$÷‚;÷9ˆ(...


    Read More

  • Windows Security Log Event ID 4730 - A security-enabled global group was deleted

    Windows Security Log Event ID 4730 Operating Systems Windows 2008 R2 and 7 Windows 2012 R2 and 8.1 Windows 2016 and 10 Windows Server 2019 and 2022 Category  • SubcategoryAccount Management  • Secu...


    Read More

  • Windows Security Log Event ID 634 - Security Enabled Global Group Deleted

    Windows Security Log Event ID 634 Operating Systems Windows Server 2000 Windows 2003 and XP CategoryAccount Management Type Success Corresponding events in Windows 2008 and Vista 4730   634: Securi...


    Read More

Related rules

to-top