Windows Event Log - Application Group Management

To audit Application Group Management in Windows system enable auditing for following event ids.

Event Id	Description
4783	A basic application group was created.
4784	A basic application group was changed.
4785	A member was added to a basic application group.
4786	A member was removed from a basic application group.
4787	A non-member was added to a basic application group.
4788	A non-member was removed from a basic application group.
4789	A basic application group was deleted.
4790	An LDAP query group was created.

Windows Event Log - Distrubution Group Management

Event Id	Description
4744	A security-disabled local group was created.
4745	A security-disabled local group was changed.
4746	A member was added to a security-disabled local group.
4747	A member was removed from a security-disabled local group.
4748	A security-disabled local group was deleted.
4749	A security-disabled global group was created.
4750	A security-disabled global group was changed.
4751	A member was added to a security-disabled global group.
4752	A member was removed from a security-disabled global group.
4753	A security-disabled global group was deleted.
4759	A security-disabled universal group was created.
4760	A security-disabled universal group was changed.
4761	A member was added to a security-disabled universal group.
4762	A member was removed from a security-disabled universal group.

Application Group Management in Windows System

There are various tasks that can be performed in Application Group Management

• An application group can be created, changed or deleted
• A member can be added to/removed from application group

The volume of this event being generated is low. And by default this events are not configured to be logged by Microsoft. However, if this policy setting is configured, it determines what tasks are performed in application group management.

Following are the lists of event that gets generated

eventId description

4783 A basic application group was created.

4784 A basic application group was changed.

4785 A member was added to a basic application group.

4786 A member was removed from a basic application group.

4787 A non-member was added to a basic application group.

4788 A non-member was removed from a basic application group.

4789 A basic application group was deleted.

4790 An LDAP query group was created.

How should these events be looked in SIEM tool?

Alert rules. Rules can be specific to above mentioned eventId or generic to Application Group Management like

LogSource=Windows eventId IN [4783, 4784, 4785, 4786, 4787, 4788, 4789, 4790]

What fields to monitor?

timestamp, user name, operationType

Distribution Group Management in Windows System

There are various tasks that can be performed in Distribution Group Management

• A distribution group is created, changed, or deleted.
• A member is added to or removed from a distribution group.

The volume of this event being generated is low and is logged only on domain controllers. And by default this events are not configured to be logged by Microsoft. However, if this policy setting is configured, it determines what tasks are performed in Distribution Group Management.

Following are the lists of event that gets generated

eventId description

4744 A security-disabled local group was created.

4745 A security-disabled local group was changed.

4746 A member was added to a security-disabled local group.

4747 A member was removed from a security-disabled local group.

4748 A security-disabled local group was deleted.

4749 A security-disabled global group was created.

4750 A security-disabled global group was changed.

4751 A member was added to a security-disabled global group.

4752 A member was removed from a security-disabled global group.

4753 A security-disabled global group was deleted.

4759 A security-disabled universal group was created.

4760 A security-disabled universal group was changed.

4761 A member was added to a security-disabled universal group.

4762 A member was removed from a security-disabled universal group.

How should these events be looked in SIEM tool?

Alert rules. Rules can be specific to above mentioned eventId or generic to Application Group Management like

LogSource=Windows eventId IN [4744, 4745, 4746, 4747, 4748, 4749, 4750, 4751, 4752, 4753, 4759, 4760, 4761, 4762]

What fields to monitor?

timestamp, who performed, security group, operationType

Security Group Management in Windows System

There are various events that gets logged when following security group management tasks are performed

• A security group is created, changed, or deleted. 
• A member is added to or removed from a security group. 
• A group's type is changed. 

The volume of this event being generated is low. And by default success events are configured to be logged by Microsoft. If policy setting are configured following are the lists of event that gets generated

eventId description

4727 A security-enabled global group was created.

4728 A member was added to a security-enabled global group.

4729 A member was removed from a security-enabled global group.

4730 A security-enabled global group was deleted.

4731 A security-enabled local group was created.

4732 A member was added to a security-enabled local group.

4733 A member was removed from a security-enabled local group.

4734 A security-enabled local group was deleted.

4735 A security-enabled local group was changed.

4737 A security-enabled global group was changed.

4754 A security-enabled universal group was created.

4755 A security-enabled universal group was changed.

4756 A member was added to a security-enabled universal group.

4757 A member was removed from a security-enabled universal group.

4758 A security-enabled universal group was deleted.

4764 A group's type was changed.

How should these events be looked in SIEM tool?

Alert rules. Rules can be specific to above mentioned eventId or generic to Application Group Management like

LogSource=Windows eventId IN [4727, 4728, 4729, 4730, 4731, 4732, 4733, 4734, 4735, 4737, 4754, 4755, 4756, 4757, 4758, 4764]

What fields to monitor?

timestamp, who performed, group name, operationType and other important information depending on the event generated.

Windows Event Log - Security Group Management

Event Id	Description
4727	A security-enabled global group was created.
4728	A member was added to a security-enabled global group.
4729	A member was removed from a security-enabled global group.
4730	A security-enabled global group was deleted.
4731	A security-enabled local group was created.
4732	A member was added to a security-enabled local group.
4733	A member was removed from a security-enabled local group.
4734	A security-enabled local group was deleted.
4735	A security-enabled local group was changed.
4737	A security-enabled global group was changed.
4754	A security-enabled universal group was created.
4755	A security-enabled universal group was changed.
4756	A member was added to a security-enabled universal group.
4757	A member was removed from a security-enabled universal group.
4758	A security-enabled universal group was deleted.
4764	A group's type was changed.