Windows Event ID 4731 — Security-Enabled Local Group Created

MITRE ATT&CK

Why It Matters

Local group creation is rare in stable environments — the vast majority of local groups are created during OS installation or software deployment, not during normal operations. Any new local group created outside a provisioning window is unusual and warrants review. The stealthy persistence angle is that a new group named SVC_Monitor or LocalBackup that includes the attacker's account and is assigned a privilege or added to Administrators is harder to detect than a direct addition to the Administrators group, because defenders typically audit group membership changes rather than group creation events.

Key Fields

Investigation Tips

1. 1.Local group creation on servers outside provisioning windows: most servers have a stable set of local groups established at deployment. Any 4731 event outside of documented deployment or patch windows should be reviewed — check the Software Installation or Change Management record for what was deployed at that time.
2. 2.Correlate with 4732 immediately after: if a member is added to the new local group within minutes of creation (4732 where the group matches the 4731 group), the attacker is loading their backdoor group. Check who was added and whether the group is subsequently assigned any privileges or added to Administrators.
3. 3.Cross-machine pattern detection: the same new group name appearing across multiple machines in a short window indicates automated lateral movement with local group backdoor deployment. An attacker using a script or C2 framework to deploy persistence will create identical groups on each compromised host — correlate 4731 events across hosts for matching Group Names.
4. 4.Check for subsequent privilege assignment: after creating a local group, an attacker may use `net localgroup Administrators SVC_Monitor /add` (generating 4732 to add the backdoor group to Administrators) or assign User Rights via Group Policy or local security policy (generating 4717). Alerting on 4731 alone misses the impact — follow the event chain through 4732 and 4717.

Related Event IDs

Frequently Asked Questions

When is local group creation legitimate?

Legitimate local group creation primarily occurs during three scenarios: (1) OS installation, when Windows creates its built-in groups like Administrators, Users, Remote Desktop Users, and others; (2) software installation, when applications like SQL Server, IIS, or backup agents create their own local service groups (e.g., IIS_IUSRS, SQLServerMSSQLUser$); (3) IT provisioning scripts that create environment-specific groups as part of a documented server configuration standard. Outside these contexts — especially during normal business hours on a production server with no corresponding change ticket — a 4731 event is unusual. The key distinguishing factor is the Subject Account Name: SYSTEM or a documented provisioning account is expected; an interactive user account or an unexpected service account is not.

How do attackers use custom local groups for persistence?

Attackers use custom local groups as an indirection layer for persistence. Rather than directly adding their backdoor account to the local Administrators group (which would appear in a 4732 alert targeting the Administrators group specifically), they create a new local group with an innocuous service-like name, add their backdoor account to that new group, and then add the new group to Administrators. This means a defender monitoring for 4732 events targeting the Administrators group will see the new group being added — which looks like a legitimate software deployment — rather than an individual user account being added. The 4731 event for the group creation, combined with the 4732 events for the membership chain, is the complete visibility needed to detect this technique.

What is the difference between Event 4731 and Event 4727?

Event 4731 is the creation of a local security group, which is machine-specific and only affects the system where it was created. Event 4727 is the creation of a global security group in Active Directory, which replicates to all domain controllers and can affect permissions across the entire domain. For attack impact, a backdoor global group (4727) that is added to Domain Admins grants domain-wide access from a single AD object; a backdoor local group (4731) grants access only on the machine where it was created, but must be deployed on each target machine individually. For detection priority, 4727 is higher impact per event, but 4731 events appearing across multiple machines simultaneously indicate a broader lateral movement campaign. Both events should be in scope for security monitoring with alerting on creation by non-provisioning accounts.