A Member Was Removed From a Security-Enabled Global Group

Title: A Member Was Removed From a Security-Enabled Global Group
Status: stable
Description:Detects activity when a member is removed from a security-enabled global group
References:
  -https://www.cisecurity.org/controls/cis-controls-list/
  -https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
  -https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
  -https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4729
  -https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=633
Author: Alexandr Yampolskyi, SOC Prime
Date: 2023-04-26
modified:None
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.t1098'

Logsource:

• product: windows
• service: security

Detection:
  selection:
    EventID:
      -'633'
      -'4729'

  condition:selection
Falsepositives:
  -Unknown
Level: low