SIEM Visualization Example 4: Users Added or Removed from a Local Group
PreviousSIEM Visualization Example 3: Successful RDP Logon Related To Service AccountsNextWhat Is Alert Triaging?
Last updated
Last updated
In this example, we will create a SIEM visualization to monitor user additions or removals from the local "Administrators" group within a specific timeframe (March 5th, 2023, to the present). This type of monitoring is critical for detecting unauthorized changes to privileged groups, which could indicate malicious activity or misconfigurations.
Spawn the Target System:
Navigate to the bottom of the section and click on "Click here to spawn the target system!".
Access Kibana:
Open your browser and navigate to http://[Target IP]:5601.
Click on the side navigation toggle and select "Dashboard".
Edit the Prebuilt Dashboard:
A prebuilt dashboard should be visible. Click on the "pencil"/edit icon to modify it.
Create a New Visualization:
Click on "Create visualization" to begin building the new visualization.
Key Elements to Configure
Filter Data:
Use the filter option to narrow down the data to only include events related to user additions or removals from the local "Administrators" group.
Add the following filters:
event.code: (4732 OR 4733) (Windows event IDs for adding/removing members from security-enabled local groups).
group.name.keyword: Administrators (Ensures the action involves the "Administrators" group).
@timestamp >= "2023-03-05T00:00:00.000Z" (Limits the data to events occurring from March 5th, 2023, onward).
Select the Index Pattern:
In the Index pattern field, specify windows* to focus on Windows-related logs.
Verify Fields:
Use the search bar to confirm the presence of fields like:
winlog.event_data.MemberSid.keyword (The SID of the user being added/removed).
group.name.keyword (The name of the group involved in the action).
event.action.keyword (Indicates whether the user was added or removed).
host.name.keyword (The machine where the action occurred).
Choose Visualization Type:
From the dropdown menu, select "Table" as the visualization type.
Configure Rows:
Click on "Rows" and configure the following fields to enhance understanding:
Field: winlog.event_data.MemberSid.keyword (Which user was added/removed?).
Field: group.name.keyword (To which group was the addition/removal performed? Double-check that it is the "Administrators" group).
Field: event.action.keyword (Was the user added or removed?).
Field: host.name.keyword (On which machine did the action occur?).
Add Metrics:
Click on "Metrics" and select "Count" as the metric.
The table will populate with data showing the count of additions/removals per user, group, and machine.
Save the Visualization:
Click on "Save and return" to add the visualization to the dashboard..
After completing the configuration, the final visualization will include:
Columns:
User: Displays the SID of the user being added or removed (winlog.event_data.MemberSid.keyword).
Group: Shows the name of the group involved in the action (group.name.keyword).
Action: Indicates whether the user was added or removed (event.action.keyword).
Machine: Displays the hostname where the action occurred (host.name.keyword).
Count: The number of times the event has occurred (based on the specified timeframe).
Filters:
Only events with event.code: (4732 OR 4733), group.name.keyword: Administrators, and @timestamp >= "2023-03-05T00:00:00.000Z" are included.
Sorting:
Sort the table by the timestamp (@timestamp) in descending order to prioritize recent events
.
Review the Dashboard:
Navigate back to the Dashboard page to view the new visualization.
Ensure that the table displays accurate and actionable insights.
Save the Dashboard:
Click on the "Save" button to save your progress.
Monitor Privileged Group Changes:
Changes to the local "Administrators" group can have significant security implications. Monitoring these changes helps detect unauthorized access or privilege escalation attempts.
Leverage Event Logs:
The event.code: 4732 and event.code: 4733 logs provide critical information about additions and removals from security-enabled local groups.
Visualization Enhances Clarity:
Using a table visualization allows SOC analysts to quickly identify patterns, such as repeated additions/removals on specific machines or involving specific users.
Best Practices:
Use .keyword fields for aggregations to ensure accurate results.
Regularly refine filters to exclude irrelevant data and reduce noise.
Combine visualizations into dashboards for a comprehensive view of security events.
Scenario: An attacker gains administrative privileges by adding their account to the local "Administrators" group. This generates an event with event.code: 4732 and group.name.keyword: Administrators.
Action: The SOC team can use this visualization to:
Identify unauthorized additions to privileged groups.
Investigate the source of the change (e.g., specific machines or users).
Revert unauthorized changes and strengthen access controls.
By following these steps, you can create a robust visualization for monitoring user additions or removals from the local "Administrators" group, enabling your SOC team to proactively detect and respond to potential threats.
