AN0865
Analytic 0865
Windows
Detects unauthorized additions of users or machine accounts to privileged local or domain groups (e.g., Administrators, Remote Desktop Users).
WinEventLog:Security
EventCode=4728, 4729, 4732, 4733, 4756, 4757
[TargetGroup]
Set to detect high-privileged groups like 'Administrators', 'Domain Admins', or 'Remote Desktop Users'
[TimeWindow]
Restrict detections to business hours or approved maintenance windows
[UserContext]
Filter out known automated processes or provisioning systems
AN0866
Analytic 0866
Linux
Detects unexpected use of usermod, gpasswd, or direct modification of /etc/group to elevate user group membership.
auditd:SYSCALL
SYSCALL for usermod or /etc/group file modification
[GroupName]
Focus on 'sudo', 'wheel', or custom high-privilege groups
[UserContext]
Account that initiated the change (e.g., service account or unrecognized user)
[TimeWindow]
Detect elevation outside change windows
AN0867
Analytic 0867
macOS
Detects use of `dseditgroup` or `dscl` to add users to privileged macOS groups (e.g., admin).
macos:unifiedlog
Process execution or directory service changes
[GroupName]
Focus on 'admin' or 'com.apple.access_ssh'
[UserContext]
Detect unknown or transient users making group changes
[TimeWindow]
Detect group modifications at suspicious times