A SIEM is ingesting Windows Security event logs. An analyst wants to detect when an account is added to a privileged group such as Domain Admins. Which Windows Event ID should trigger the detection rule?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because Event ID 4728 (global security group) and 4732 (local security group) record when accounts are added to security groups; for Domain Admins (a global security group), Event ID 4728 fires, making these the correct events for detecting unauthorized privilege escalation via group membership changes. A is wrong because Event ID 4625 records failed logons, not group membership changes.
Full explanation below image
Full Explanation
B is correct because Event ID 4728 (global security group) and 4732 (local security group) record when accounts are added to security groups; for Domain Admins (a global security group), Event ID 4728 fires, making these the correct events for detecting unauthorized privilege escalation via group membership changes. A is wrong because Event ID 4625 records failed logons, not group membership changes. C is wrong because Event ID 4720 records the creation of a new account, not the addition of an existing account to a group. D is wrong because Event ID 4776 records NTLM credential validation, not group membership changes.