Windows Event ID 4735: A security-enabled local group was changed
- Applicable version
- Windows Server 2008 and later where the audit subcategory is enabled
- Last reviewed
- 2026-07-22
Quick summary
Windows Security Event ID 4735 records a change to a security-enabled local group.
Technical Metadata
| Event ID | 4735 |
|---|---|
| Provider | Microsoft-Windows-Security-Auditing |
| Channel | Security |
| Level | Information |
| MITRE ATT&CK | TA0003 Persistence / T1098 Account Manipulation |
| Key fields to watch | Group Name / Group Domain / Group Security ID, Changed Attributes, Subject Logon ID |
Trigger Scenarios
Microsoft documents that this event is generated when a security-enabled local group is changed on domain controllers, member servers, and workstations, though some property changes do not invoke it.
Key Fields
Group Name / Group Domain / Group Security ID
The changed local group; privileged groups need additional scrutiny.
Changed Attributes
Fields such as SamAccountName and SidHistory may show what changed, but Microsoft notes some changes produce limited detail.
Subject Logon ID
Hexadecimal actor session to correlate with 4624 and process creation.
Threat Hunting Queries
SecurityEvent
| where EventID == 4735
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc- Data source
- Microsoft Sentinel SecurityEvent table
- Assumptions
- The Windows Security Events connector populates SecurityEvent. Map raw XML fields to the documented fields.
index=wineventlog source="WinEventLog:Security" EventCode=4735
| table _time, host, EventCode, Message- Data source
- Splunk Windows Security event data
- Assumptions
- Index and parsed field names vary by deployment. Add the documented event-specific conditions after field validation.
dataset = microsoft_windows_raw
| filter edr_event_id = 4735- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- The Windows Security channel is ingested. Inspect raw fields because parsed names vary.
title: Windows Security Event ID 4735
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 4735
condition: selection
falsepositives:
- Legitimate administrative or system activity
level: informational- Data source
- Sigma Windows Security log source
- Assumptions
- This retrieves the event and is not a standalone malicious-behavior detection.
Documented Values and Codes
| Field | Value | Meaning | Security relevance |
|---|---|---|---|
| GroupName | Administrators | The changed local group; compare against the privileged-group inventory. | Interpret GroupName with the full event and correlated activity; this value alone is not proof of compromise. Source |
| SidHistory | - | Microsoft uses a dash when an attribute is not populated in the event. | Interpret SidHistory with the full event and correlated activity; this value alone is not proof of compromise. Source |
MITRE ATT&CK Mapping
- T1098Account Manipulation
Detection Notes
Use threshold=1 for 4735 on Administrators, Remote Desktop Users, or backup/operator groups when Changed Attributes include SidHistory or SamAccountName changes, or when 4732/4733 occurs nearby. Microsoft documents 4735 as local security group change telemetry and notes it can precede membership events; changing privileged group properties can support T1098 Account Manipulation even when membership is not shown in this event. Correlate Subject Logon ID with 4624/4688 and directory or local SAM management activity.
Common False Positives
- Group Policy and endpoint management commonly refresh local group attributes.
- Administrative maintenance can rename or update group metadata without changing membership.
Related Events
Sample Log
EventID: 4735
Subject Account Name: admin.ops
Subject Logon ID: 0x27a79
Group Name: Administrators
Group Domain: HOST01
Changed Attributes: SamAccountName=Administrators; SidHistory=-Frequently Asked Questions
What does Windows Event ID 4735 mean?
Attributes of a security-enabled local group changed.
Does Event ID 4735 always indicate malicious activity?
No. Authorized group administration can generate it.
How should Event ID 4735 be investigated?
Compare changed attributes with baseline and correlate nearby membership events and the subject logon session.
Sources
- 4735: A security-enabled local group was changed
Microsoft · vendor
- Account Manipulation (T1098)
MITRE ATT&CK · attack
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule