Windows Event ID 4756: A member was added to a security-enabled universal group
- Applicable version
- Windows Server 2008 and later where the audit subcategory is enabled
- Last reviewed
- 2026-07-22
Quick summary
Windows Security Event ID 4756 records addition of a member to a security-enabled universal group.
Technical Metadata
| Event ID | 4756 |
|---|---|
| Provider | Microsoft-Windows-Security-Auditing |
| Channel | Security |
| Level | Information |
| MITRE ATT&CK | TA0003 Persistence / T1098.007 Account Manipulation: Additional Local or Domain Groups |
| Key fields to watch | Member Security ID / Account Name, Group Name / Group Domain / Group Security ID, Expiration time / Privileges |
Trigger Scenarios
Microsoft documents 4756 as the universal-group counterpart to 4732, with the same fields and recommendations except group type.
Key Fields
Member Security ID / Account Name
The principal added to the universal security group.
Group Name / Group Domain / Group Security ID
The affected universal group, which can be granted access in any trusting domain.
Expiration time / Privileges
Newer event versions may include membership expiration time; privileges captures special rights involved in the change.
Threat Hunting Queries
SecurityEvent
| where EventID == 4756
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc- Data source
- Microsoft Sentinel SecurityEvent table
- Assumptions
- The Windows Security Events connector populates SecurityEvent. Map raw XML fields to the documented fields.
index=wineventlog source="WinEventLog:Security" EventCode=4756
| table _time, host, EventCode, Message- Data source
- Splunk Windows Security event data
- Assumptions
- Index and parsed field names vary by deployment. Add the documented event-specific conditions after field validation.
dataset = microsoft_windows_raw
| filter edr_event_id = 4756- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- The Windows Security channel is ingested. Inspect raw fields because parsed names vary.
title: Windows Security Event ID 4756
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 4756
condition: selection
falsepositives:
- Legitimate administrative or system activity
level: informational- Data source
- Sigma Windows Security log source
- Assumptions
- This retrieves the event and is not a standalone malicious-behavior detection.
Documented Values and Codes
| Field | Value | Meaning | Security relevance |
|---|---|---|---|
| MemberSid | SID | The principal added to the universal security group. | Interpret MemberSid with the full event and correlated activity; this value alone is not proof of compromise. Source |
| ExpirationTime | - | A blank or dash value means no temporary membership expiry is represented. | Interpret ExpirationTime with the full event and correlated activity; this value alone is not proof of compromise. Source |
MITRE ATT&CK Mapping
- T1098.007Account Manipulation: Additional Local or Domain Groups
Detection Notes
Use threshold=1 for additions to privileged universal groups or groups granting cross-domain access, especially when Expiration time is blank or unexpectedly long. Microsoft documents 4756 as the universal-group equivalent of 4732; adding a Member Security ID to a universal security group can extend access across trusting domains and supports T1098.007 Additional Local or Domain Groups. Correlate Subject Logon ID with 4624/4688 and validate the provisioning request.
Common False Positives
- Approved cross-domain access provisioning can add users to universal groups.
- Identity governance platforms may add temporary group memberships with expiration time.
Related Events
Sample Log
EventID: 4756
Subject Account Name: admin.ops
Subject Logon ID: 0x27a79
Member Security ID: S-1-5-21-111-222-333-1109
Member Account Name: CN=svc-sync,CN=Users,DC=corp,DC=local
Group Name: Forest-App-Admins
Group Domain: CORP
Expiration time: -Frequently Asked Questions
What does Windows Event ID 4756 mean?
A member was added to a security-enabled universal group.
Does Event ID 4756 always indicate malicious activity?
No. Normal provisioning and role management generate it.
How should Event ID 4756 be investigated?
Assess group privilege and cross-domain reach, validate expiration and approval, and correlate the subject logon with process activity.
Sources
- 4756: A member was added to a security-enabled universal group
Microsoft · vendor
- Account Manipulation: Additional Local or Domain Groups (T1098.007)
MITRE ATT&CK · attack
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule