Rapid group membership changes
A burst of security-group membership modifications on one host in a short window — members added (Security 4732 local / 4728 global / 4756 universal) or…
What it detects
A burst of security-group membership modifications on one host in a short window — members added (Security 4732 local / 4728 global / 4756 universal) or removed (4733 / 4729 / 4757), counted together as churn. A single change is routine (see windows.account.added_to_administrators); a rapid run of them on the same machine is the behavioural signal: mass privilege farming, an attacker cycling an account through several privileged groups, or a script bulk-editing membership then cleaning up. This is the threshold-burst realisation of a catalogued behaviour; because it keys on the normalised account/group_membership_changed + group_member_removed actions (not raw event IDs), it fires on any source that maps to those, not just Windows Security.
MITRE ATT&CK mapping
False positives and triage
Bulk onboarding/offboarding, an IdM sync, or a group-nesting cleanup also produce membership-change bursts. Confirm the actor is an authorised admin process tied to a change ticket; treat bursts by a non-IT account, outside business hours, or that add the same principal to multiple privileged groups as high priority. Overlaps the single-event added_to_administrators rule on known formats; duplicates group into one incident by host.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/windows/rapid_group_membership_changes.yaml, licensed under the Apache License 2.0.
id: windows.privilege_abuse.rapid_group_membership_changes
version: 1.0.0
status: stable
severity: high
confidence: 0.6
platforms: [windows]
mitre_techniques: [T1098, T1078]
description: |
A burst of security-group membership modifications on one host in a short window —
members added (Security 4732 local / 4728 global / 4756 universal) or removed (4733 /
4729 / 4757), counted together as churn. A single change is routine (see
windows.account.added_to_administrators); a rapid run of them on the same machine is the
behavioural signal: mass privilege farming, an attacker cycling an account through
several privileged groups, or a script bulk-editing membership then cleaning up. This is
the threshold-burst realisation of behavioural catalog BEH-067; because it keys on the
normalised account/group_membership_changed + group_member_removed actions (not raw
event IDs), it fires on any source that maps to those, not just Windows Security.
match:
event_category: account
event_action_any: [group_membership_changed, group_member_removed]
threshold:
count: 5
window_seconds: 300
group_by: [hostname]
correlation_keys: [hostname]
false_positive_guidance: |
Bulk onboarding/offboarding, an IdM sync, or a group-nesting cleanup also produce
membership-change bursts. Confirm the actor is an authorised admin process tied to a
change ticket; treat bursts by a non-IT account, outside business hours, or that add the
same principal to multiple privileged groups as high priority. Overlaps the single-event
added_to_administrators rule on known formats; duplicates group into one incident by host.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.