Added to administrators
Detects a member being added to the local Administrators group (Security 4732 for the built-in Administrators SID).
What it detects
Detects a member being added to the local Administrators group (Security 4732 for the built-in Administrators SID). Instant privilege escalation persistence.
MITRE ATT&CK mapping
- T1098Account Manipulation· Persistence
False positives and triage
Legitimate admin onboarding also lands here. Confirm through the change process; treat additions outside business hours or by non-IT accounts as high priority.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 75%. Source: rules/windows/added_to_administrators.yaml, licensed under the Apache License 2.0.
id: windows.account.added_to_administrators
version: 1.0.0
status: stable
severity: high
confidence: 0.75
platforms: [windows]
mitre_techniques: [T1098]
description: |
Detects a member being added to the local Administrators group (Security 4732 for the
built-in Administrators SID). Instant privilege escalation persistence.
match:
event_category: account
event_action: group_membership_changed
raw_message_contains_any: ["Administrators", "Administrateurs", "Administratoren"]
false_positive_guidance: |
Legitimate admin onboarding also lands here. Confirm through the change process; treat
additions outside business hours or by non-IT accounts as high priority.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.