Group Created
Enabled by default
Service: Microsoft Windows Security auditing
Log type: Security
Groups allow for multiple user accounts to be managed as one and an attacker may try and create a group with escalated privileges.
Get-WinEvent -FilterHashTable @{LogName='Security';ID='4731'} -MaxEvents 1 | Format-List auditpol /get /subcategory:"security group management"
auditpol /set /subcategory:"security group management" /Success:Disable /Failure:Disable
auditpol /set /subcategory:"security group management" /Success:Enable /Failure:Enable
Compliance
HIPAA
Level: Recommended
PCI DSS
Level: Recommended
https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf?agreement=true&time=1631643252599
NSA Event Forwarding
Level: Recommended
https://github.com/nsacyber/Event-Forwarding-Guidance/tree/master/Events
Group Creation is logged automatically by Windows 10 Professional. To view, navigate to the Event Viewer and the security channel. To view the group creation log, sort or filter for the ID 4731.
To view this log in the command line with Get-WinEvent, open PowerShell as an administrator. From here, enter the command Get-WinEvent -FilterHashTable @{LogName='Security';ID='4731'} -MaxEvents 1 | Format-List
To view this log in the command line with wevtutil, open PowerShell or Command Prompt as an administrator. From here, enter the command wevtutil qe Security "/q:*[System [(EventID=4731)]]"
