Windows Event ID 4756 — Member Added to Universal Security Group
Logged when an account is added to a universal security group in Active Directory.
MITRE ATT&CK
Technique
T1098 · Account Manipulation
Tactic
Persistence
Why It Matters
Universal groups can span domains in a forest, making additions to privileged universal groups (e.g., Enterprise Admins) forest-wide in impact.
Key Fields
Group NameThe target group
Member Account NameWho was added
Subject Account NameWho performed the addition
Investigation Tips
- 1.Treat like 4728 for Enterprise Admins or other privileged universal groups.
- 2.Verify against change control records.
Go deeper: the full Account Persistence — Backdoor Accounts and Unauthorized Group Changes guide
Explore the related technique, investigation steps, and evidence to consider alongside this event.
Read the Account Persistence — Backdoor Accounts and Unauthorized Group Changes guide →See Event ID 4756 in your logs
Copy the event details as XML and inspect them in your browser. No file upload or hosted analysis is needed.
Decode an event →