Privileged group enumeration
The membership of a privileged local group was enumerated (Windows 4799), or an account's group memberships were listed (4798).
What it detects
The membership of a privileged local group was enumerated (Windows 4799), or an account's group memberships were listed (4798).
This is the reconnaissance step between landing on a host and choosing what to attack next: "who is a local administrator here" tells an operator which account to steal and which machine is worth moving to. net localgroup administrators, PowerView's Get-NetLocalGroup and BloodHound's local-group collection all produce it.
Scoped to the groups that actually confer power — enumerating an ordinary application group is not interesting, and including it would drown the signal. Medium severity on purpose: enumeration is preparation, not compromise, and its value is as a timestamp in the sequence rather than as a standalone incident.
MITRE ATT&CK mapping
False positives and triage
Windows itself enumerates these groups routinely, and management, inventory and vulnerability-scanning tools do it across the estate on a schedule — expect a steady background rate and baseline it before treating any single event as a lead.
To confirm: read CallerProcessName. net1.exe, powershell.exe, wmic.exe or a binary in a user directory is an operator at a keyboard; svchost.exe, mmc.exe, or your inventory agent is routine. Then look at WHO ran it and what else that account did in the following minutes — enumeration immediately before a logon to a machine the account has never touched is the pattern that matters.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/windows/privileged_group_enumeration.yaml, licensed under the Apache License 2.0.
id: windows.discovery.privileged_group_enumeration
version: 1.0.0
status: stable
severity: medium
confidence: 0.6
platforms: [windows]
mitre_techniques: [T1069.001, T1087.001]
description: |
The membership of a privileged local group was enumerated (Windows 4799), or an
account's group memberships were listed (4798).
This is the reconnaissance step between landing on a host and choosing what to
attack next: "who is a local administrator here" tells an operator which account
to steal and which machine is worth moving to. `net localgroup administrators`,
PowerView's `Get-NetLocalGroup` and BloodHound's local-group collection all
produce it.
Scoped to the groups that actually confer power — enumerating an ordinary
application group is not interesting, and including it would drown the signal.
Medium severity on purpose: enumeration is preparation, not compromise, and its
value is as a timestamp in the sequence rather than as a standalone incident.
match:
native_event_id_any: ['4798', '4799']
raw_message_contains_any:
- 'TargetUserName=Administrators'
- 'TargetUserName=Domain Admins'
- 'TargetUserName=Enterprise Admins'
- 'TargetUserName=Backup Operators'
- 'TargetUserName=Remote Desktop Users'
- 'TargetUserName=Account Operators'
- 'TargetUserName=Server Operators'
correlation_keys: [hostname, user_name]
false_positive_guidance: |
Windows itself enumerates these groups routinely, and management, inventory and
vulnerability-scanning tools do it across the estate on a schedule — expect a
steady background rate and baseline it before treating any single event as a lead.
To confirm: read `CallerProcessName`. `net1.exe`, `powershell.exe`, `wmic.exe` or a
binary in a user directory is an operator at a keyboard; `svchost.exe`, `mmc.exe`,
or your inventory agent is routine. Then look at WHO ran it and what else that
account did in the following minutes — enumeration immediately before a logon to
a machine the account has never touched is the pattern that matters.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.