Skip to main content
Tier One
Medium

Helpdesk technician added to a local Administrators group

A-1056

00:00time on this alert, target 20 minutes

Back to queue

Alert details

Source
SIEM Correlation
Detection rule
SIEM-PRIVESC-LOCAL-005
Affected user
a.brennan
Affected host
WKS-QA-11
Source IP
—
First seen
2026-07-24T15:55:00Z

Why this fired, in plain English

An account was added to the local administrators group on one computer.

Suggested playbook

Privilege escalation

  1. 1. Establish scope: local group (4732) or domain group (4728)?
  2. 2. Check for an approved change ticket or helpdesk ticket covering the grant.
  3. 3. Check whether the rights were later removed (4733/4729) — clean-up suggests legitimate work.
  4. 4. Identify who performed the action and from which host and IP.
Open the full checklist

Raw log evidence

Exactly what the tools recorded — 3 events.

  1. Guided hint: this line matters

    ts=2026-07-24T15:54:02Z host=WKS-QA-11 EventID=4732 group="Administrators" member="northwind\\a.brennan" caller="northwind\\a.brennan" scope=local

    4732 = added to a LOCAL group on one machine, which is much narrower than a domain group.

  2. Guided hint: this line matters

    ts=2026-07-24T15:50:11Z src="itsm" event=ticket_open ticket="INC-9921" summary="QA lab PC cannot install calibration driver" assignee="a.brennan" requester="t.alvarez"

    There is a matching helpdesk ticket from the machine's own user asking for exactly this fix.

  3. Guided hint: this line matters

    ts=2026-07-24T16:12:30Z host=WKS-QA-11 EventID=4733 group="Administrators" member="northwind\\a.brennan" caller="northwind\\a.brennan"

    4733 = removed from the group. The admin cleaned up after himself 18 minutes later.

Related events

The order things happened in.

  1. 15:50Z

    Helpdesk ticket INC-9921 opened

  2. 15:54Z

    Temporary local admin granted

  3. 16:12Z

    Local admin rights removed

Enrichment lookups

Mock lookups. Run each one yourself — a real analyst never guesses what a lookup would have said. There is no "run everything" button on purpose.

0 of 3 lookups checked

  • Not checked yet.

  • Not checked yet.

  • Not checked yet.

techniques

Your verdict

Keyboard shortcuts 1–4, or click. You can always change your mind afterwards.