Event ID 4728: Member added to global group

• Identity management and HR-driven provisioning adding users to role groups.
• Administrators granting access through application or department groups.
• Temporary membership granted by privileged access management tools, followed later by 4729.

• Privilege escalation or persistence by adding a controlled account to Domain Admins or another privileged global group.
• Adding a newly created account (4720) to a privileged group within minutes of its creation.
• Adding accounts to groups that hold delegated rights on AD objects, Group Policy or servers, which is quieter than Domain Admins.

• Alert on additions to privileged groups by SID and verify each against an approved change.
• Check whether the member was created recently (4720) and what it did next (4624, 4672, 4769).
• Pivot on SubjectLogonId and the DC's 4624 events to find the host the change was made from.
• Look for a later 4729 removing the same member — brief membership is a common way to avoid detection.

MITRE ATT&CK v19.2. Technique and tactic names are MITRE's.

1 SigmaHQ detection rules (release r2026-07-01) target this event.

• Low · 1

• LowA Member Was Added to a Security-Enabled Global GroupRule by Alexandr Yampolskyi, SOC Prime, SigmaHQ, DRL 1.1

Rules by their named authors, published by SigmaHQ under the Detection Rule License (DRL) 1.1.

• 4729Member removed from global groupSecurity→
• 4727Global group createdSecurity→
• 4737Global group changedSecurity→
• 4732Member added to local groupSecurity→
• 4756Member added to universal groupSecurity→
• 4720User account createdSecurity→
• 4624Successful logonSecurity→
• 4672Special privileges assignedSecurity→
• 5136AD object modifiedSecurity→

• Microsoft Learn — Audit Security Group Management (4728 description)
• Microsoft Learn — 4732(S): A member was added to a security-enabled local group