UnknownMicrosoft Sentinel analytics
User Account added to Built in Sensitive or Privileged Domain Local or Global Group
User account was added to a privileged built in domain local group or global group such as the Enterprise Adminis, Cert Publishers or DnsAdmins Be sure to verify this is an expected addition.
Detection logic
Detection requirements
- Platform
- ContainersESXiIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows
The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.
- Log source product
- securityeventswindowssecurityevents
- Log source service
- securityevent
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
No references are available for this detection.
From the source
- At source
- Open at source
- Upstream identifier
- 8d69a665-074a-443b-aae6-5dd9bdd5cfb1
- Tagged by the source as
- PersistencePrivilegeEscalation
Licence
- Published under
- MIT LicenseRead the licence
- Attribution
- Required
- Obtained under
- MITRead the origin licence
Authorship
- Published
- Sep 1, 2026
- Version
- 1