Event ID 4732: A member was added to a security-enabled local group
Written when an account is added to a local group (such as Administrators on a workstation) or a domain-local group.
- Log
- Security
- Category
- Group management
Why it matters
- Being added to the local Administrators group is a common step after an attacker creates an account (4720).
What to check
Check the group, the member added and who made the change.
How to turn it on
Advanced Audit Policy: Account Management > Audit Security Group Management.
MITRE ATT&CK
- T1098 Account Manipulation