Skip to content
Sign In
Learn

T1098.007

Additional Local or Domain Groups

Also appears in: Privilege Escalation

Index entry

In-depth coverage of this technique (how it looks in telemetry, how to hunt it, and how to rule out benign activity) is coming soon. It's in our catalog and on the roadmap to be written up.

View this technique on MITRE ATT&CK →

Telemetry needed

The log events that help detect this technique, from the Telemetry reference: which log source to collect, which event in it, and how to enable each one.

  • Linux audit framework (auditd) (the log as a whole)
  • macOS unified log (the log as a whole)
  • Windows Security event log
    • 4728 A member was added to a security-enabled global group.
    • 4729 A member was removed from a security-enabled global group.
    • 4732 A member was added to a security-enabled local group.
    • 4733 A member was removed from a security-enabled local group.
    • 4756 A member was added to a security-enabled universal group.
    • 4757 A member was removed from a security-enabled universal group.