topic Re: Who Added User X to a Specific AD Security Group? in Splunk Enterprise

Who added user x to a specific AD Security Group?

itsmevic70 — Mon, 12 Dec 2022 15:01:29 GMT

Hi, I'm curious if anyone has a query that can help provide some insight into something I am trying to figure out. The issue is regarding a user that was not a member of the Admin's security group on 5/6/22 but did on 6/2/22. For the life of me, I cannot find out who added this user to that group. I'm using the following query, but it's not providing anything meaningful. Any help is solving this mystery is greatly appreciated.

eventtype=wineventlog_security (EventCode=4727 OR EventCode=4730 OR EventCode=4731 OR EventCode=4734 OR EventCode=4735 OR EventCode=4737 OR EventCode=4744 OR EventCode=4745 OR EventCode=4748 OR EventCode=4749 OR EventCode=4750 OR EventCode=4753 OR EventCode=4754 OR EventCode=4755 OR EventCode=4758 OR EventCode=4759 OR EventCode=4760 OR EventCode=4763 OR EventCode=4764)
| stats count by _time,Security_ID,EventCodeDescription,member_dn
| rename member_dn as Change_Made_By

Re: Who Added User X to a Specific AD Security Group?

richgalloway — Fri, 09 Dec 2022 20:36:52 GMT

Have you tried event code 4728 or 4732?

As I understand it, the Subject.Account_Name field contains the name of the user added to the group. The user who made the change is in the Member.Account_Name field. I don't see the member_dn field documented.

Re: Who Added User X to a Specific AD Security Group?

johnhuang — Fri, 09 Dec 2022 20:53:07 GMT

source=WinEventLog:Security EventCode IN (4728, 4732, 4746, 4751, 4756, 4761, 4729, 4733, 4747, 4752, 4757, 4762, 4786, 4788) earliest=-7d@d | eval changed_by=mvindex(Security_ID, 0) | eval member_id=mvindex(Security_ID, 1) | eval group_id=mvindex(Security_ID, 2) | rex "A member was (?<change_type>(added|removed))" | eval host_name=coalesce(src_nt_host, dvc_nt_host, host) | rename EventCode as event_code EventCodeDescription AS event_desc | table _time host_name changed_by change_type group_id member_id event_code event_desc