Event ID 4799: A security-enabled local group membership was enumerated
Written when a process lists the members of a local group, such as Administrators.
- Log
- Security
- Category
- Discovery
Why it matters
- 'net localgroup administrators' run by a user or an unusual process is classic discovery.
What to check
Check Process Name and the account; look for the matching 4688 command line.
How to turn it on
Advanced Audit Policy: Account Management > Audit Security Group Management.
MITRE ATT&CK
- T1069.001 Permission Groups Discovery: Local Groups