Event ID 4798: A user's local group membership was enumerated
Written when a process lists the local groups a user belongs to.
- Log
- Security
- Category
- Discovery
Why it matters
- Normal Windows components do this often. Unusual processes doing it for many users can be reconnaissance.
What to check
Check Process Name and the account doing the enumeration; filter out known system processes.
How to turn it on
Advanced Audit Policy: Account Management > Audit User Account Management.
MITRE ATT&CK
- T1087.001 Account Discovery: Local Account