Skip to main content
Tier One
Critical

User account added to Domain Admins outside a change window

A-1055

00:00time on this alert, target 5 minutes

Back to queue

Alert details

Source
SIEM Correlation
Detection rule
SIEM-PRIVESC-DA-001
Affected user
m.okafor
Affected host
SRV-DC-01
Source IP
—
First seen
2026-07-24T15:47:00Z

Why this fired, in plain English

Someone was added to the most powerful group in the Windows domain, and there was no approved change request for it.

Suggested playbook

Privilege escalation

  1. 1. Establish scope: local group (4732) or domain group (4728)?
  2. 2. Check for an approved change ticket or helpdesk ticket covering the grant.
  3. 3. Check whether the rights were later removed (4733/4729) — clean-up suggests legitimate work.
  4. 4. Identify who performed the action and from which host and IP.
Open the full checklist

Raw log evidence

Exactly what the tools recorded — 4 events.

  1. Guided hint: this line matters

    ts=2026-07-24T15:46:12Z host=SRV-DC-01 EventID=4728 group="Domain Admins" member="northwind\\svc-report" caller="northwind\\m.okafor" src_ip=10.20.14.61

    4728 = a member was added to a security-enabled global group. Domain Admins can do anything, anywhere.

  2. Guided hint: this line matters

    ts=2026-07-24T15:46:40Z host=SRV-DC-01 EventID=4738 account="northwind\\svc-report" changes="PasswordNeverExpires=true;UserAccountControl=0x10200"

    The account was then modified so its password never expires — the attacker is building a durable back door.

  3. Guided hint: this line matters

    ts=2026-07-24T15:47:00Z src="itsm" event=change_lookup account="svc-report" window_match=none result="no approved change"
  4. ts=2026-07-24T15:47:12Z host=SRV-DC-01 EventID=4624 account="svc-report" src_ip=10.20.14.61 logon_type=3

Related events

The order things happened in.

  1. 15:46Z

    svc-report added to Domain Admins

  2. 15:46Z

    Password-never-expires set

  3. 15:47Z

    New admin account used from the compromised workstation

Enrichment lookups

Mock lookups. Run each one yourself — a real analyst never guesses what a lookup would have said. There is no "run everything" button on purpose.

0 of 4 lookups checked

  • Not checked yet.

  • Not checked yet.

  • Not checked yet.

  • Not checked yet.

techniques

Your verdict

Keyboard shortcuts 1–4, or click. You can always change your mind afterwards.