Group Modification Logging

Configure systems to issue a log entry and alert when an account is added to or removed from any group assigned administrative privileges. Sigma detects Event ID 4728 indicates a ‘Member is added to a Security Group’. Event ID 4729 indicates a ‘Member is removed from a Security enabled-group’. Event ID 4730 indicates a‘Security Group is deleted’. The case is not applicable for Unix OS. Supported OS - Windows 2008 R2 and 7, Windows 2012 R2 and 8.1, Windows 2016 and 10 Windows Server 2019, Windows Server 2000, Windows 2003 and XP.

Rule Content

- title: Group Modification Logging
  id: 9cf01b6c-e723-4841-a868-6d7f8245ca6e
  description: "Configure systems to issue a log entry and alert when an account is\
    \ added to or removed from any group assigned administrative privileges. Sigma\
    \ detects Event ID 4728 indicates a \u2018Member is added to a Security Group\u2019\
    . Event ID 4729 indicates a \u2018Member is removed from a Security enabled-group\u2019\
    . Event ID 4730 indicates a\u2018Security Group is deleted\u2019. The case is\
    \ not applicable for Unix OS. Supported OS - Windows 2008 R2 and 7, Windows 2012\
    \ R2 and 8.1, Windows 2016 and 10 Windows Server 2019, Windows Server 2000, Windows\
    \ 2003 and XP."
  author: Alexandr Yampolskyi, SOC Prime
  status: stable
  references:
  - https://www.cisecurity.org/controls/cis-controls-list/
  - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
  - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4728
  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4729
  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4730
  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=633
  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=632
  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=634
  date: 2019/03/26
  logsource:
    product: windows
    service: security
    category: null
  detection:
    selection:
      EventID:
      - 4728
      - 4729
      - 4730
      - 633
      - 632
      - 634
    condition: selection
  falsepositives:
  - unknown
  level: low
  tags:
  - CSC4
  - CSC4.8
  - NIST CSF 1.1 PR.AC-4
  - NIST CSF 1.1 PR.AT-2
  - NIST CSF 1.1 PR.MA-2
  - NIST CSF 1.1 PR.PT-3
  - ISO 27002-2013 A.9.1.1
  - ISO 27002-2013 A.9.2.2
  - ISO 27002-2013 A.9.2.3
  - ISO 27002-2013 A.9.2.4
  - ISO 27002-2013 A.9.2.5
  - ISO 27002-2013 A.9.2.6
  - ISO 27002-2013 A.9.3.1
  - ISO 27002-2013 A.9.4.1
  - ISO 27002-2013 A.9.4.2
  - ISO 27002-2013 A.9.4.3
  - ISO 27002-2013 A.9.4.4
  - PCI DSS 3.2 2.1
  - PCI DSS 3.2 7.1
  - PCI DSS 3.2 7.2
  - PCI DSS 3.2 7.3
  - PCI DSS 3.2 8.1
  - PCI DSS 3.2 8.2
  - PCI DSS 3.2 8.3
  - PCI DSS 3.2 8.7

Querying Elasticsearch

Import Libraries



In [ ]:

    
from elasticsearch import Elasticsearch
from elasticsearch_dsl import Search
import pandas as pd

Initialize Elasticsearch client



In [ ]:

    
es = Elasticsearch(['http://helk-elasticsearch:9200'])
searchContext = Search(using=es, index='logs-endpoint-winevent-security-*', doc_type='doc')

Run Elasticsearch Query



In [ ]:

    
s = searchContext.query('query_string', query='event_id:("4728" OR "4729" OR "4730" OR "633" OR "632" OR "634")')
response = s.execute()
if response.success():
    df = pd.DataFrame((d.to_dict() for d in s.scan()))

Show Results



In [ ]:

    
df.head()