A Member Was Removed From a Security-Enabled Global Group — Sigma Rule

Rule metadata and linked tags

Author: Alexandr Yampolskyi, SOC Prime. Source status: stable; severity: low. Source dates: 2023-04-26 / not supplied.

{
  "product": "windows",
  "service": "security"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: d74ceda9bc8a5eae25dbbe03ad2ab74259cc61cd4bdbc35295a0b6cff095bcca

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: A Member Was Removed From a Security-Enabled Global Group
id: 02c39d30-02b5-45d2-b435-8aebfe5a8629
related:
    - id: 9cf01b6c-e723-4841-a868-6d7f8245ca6e
      type: obsolete
status: stable
description: Detects activity when a member is removed from a security-enabled global group
references:
    - https://www.cisecurity.org/controls/cis-controls-list/
    - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
    - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
    - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4729
    - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=633
author: Alexandr Yampolskyi, SOC Prime
date: 2023-04-26
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1098
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID:
            - 633 # Security Enabled Global Group Member Removed
            - 4729 # A member was removed from a security-enabled global group
    condition: selection
falsepositives:
    - Unknown
level: low

Original YAML and metadata in JSON

False positives

• Unknown

Source references

• https://www.cisecurity.org/controls/cis-controls-list/
• https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
• https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
• https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4729
• https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=633