Member Removed From Security-Enabled Global Group

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•25

This rule detects when a member is removed from a security-enabled global group in a Windows environment. This activity is captured by Event IDs 633 and 4729 in the Windows Security event log. Such an action could indicate an attempt to reduce an account's privileges, remove an adversary's access, or modify group memberships for other malicious purposes.