Windows Event ID 4728 — Member Added to Global Security Group

MITRE ATT&CK

Why It Matters

Unauthorized addition to Domain Admins is one of the highest-severity events in Active Directory. Domain Admins have unrestricted access to every domain-joined system, can reset any password, replicate the domain database (DCSync), and modify Group Policy. Attackers add accounts to Domain Admins immediately after compromise to establish persistence that survives password resets on the original attack vector. The pattern 4720 (account created) + 4728 (added to Domain Admins) within seconds is a near-definitive backdoor account IOC — the new account retains elevated access even if the original compromised account is disabled.

Key Fields

Investigation Tips

1. 1.Alert on any addition to Domain Admins, Enterprise Admins, Schema Admins, or Group Policy Creator Owners — these changes are rare in most environments and should always be validated against a change management ticket.
2. 2.Backdoor account IOC: 4720 (account created) + 4728 targeting Domain Admins within 60 seconds, both sharing the same Subject Account Name. This sequence is the attacker establishing durable persistence — the new account retains elevated access even after the original compromise is remediated.
3. 3.DNSAdmins is critically underrated: members can instruct the DC's DNS service to load an arbitrary DLL (via dnscmd.exe /config /serverlevelplugindll), granting SYSTEM code execution on the domain controller. Alert on DNSAdmins additions with Domain Admins-level urgency.
4. 4.Validate the Subject Account Name performing the addition — should be a known directory admin, not a service account, workstation account, or standard user. Correlate the Subject Logon ID with 4624 to check the source IP and logon type.
5. 5.Timing is a signal: additions at 2–5 AM, or immediately following a 4625 brute-force spike and 4624 success, are high-confidence attacker activity. Legitimate AD group management rarely occurs outside business hours without a change ticket.
6. 6.After any suspicious 4728, check 4624 for the newly added account — if it logs on within seconds or minutes, the attacker is actively exploiting the elevated access.

Detection Logic (KQL)

Microsoft Sentinel (KQL) — alert on privileged group additions and the backdoor account creation IOC (4720+4728 within 60 seconds from the same actor).

// Alert on additions to Tier 1 privileged groups
SecurityEvent
| where EventID == 4728
| where TargetUserName in ("Domain Admins", "Enterprise Admins", "Schema Admins",
    "Group Policy Creator Owners", "DnsAdmins")
| project TimeGenerated, SubjectAccount, MemberName, TargetUserName, Computer
| sort by TimeGenerated desc

// Backdoor account IOC: 4720 + 4728 within 60 seconds (same Subject)
let newAccounts = SecurityEvent
| where EventID == 4720
| project CreateTime=TimeGenerated, SubjectAccount, NewAccount=TargetAccount;
let groupAdds = SecurityEvent
| where EventID == 4728
| where TargetUserName has_any ("Domain Admins", "Enterprise Admins")
| project AddTime=TimeGenerated, SubjectAccount, AddedAccount=MemberName;
newAccounts
| join kind=inner groupAdds on SubjectAccount
| where abs(datetime_diff('second', AddTime, CreateTime)) <= 60
| project CreateTime, AddTime, SubjectAccount, NewAccount, Computer

Related Event IDs