Windows Event ID 4727 – Microsoft-Windows-Security-Auditing: Security-Enabled Global Group Created

Start by examining the event details directly in Event Viewer to understand the context of the group creation.

1. Open Event Viewer on the domain controller where the event occurred
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4727 using the filter option or search functionality
4. Double-click the event to view detailed information including:
   • Subject: Account that created the group
   • New Group: Details of the created group
   • Attributes: Initial group properties and settings
5. Note the timestamp, source workstation, and logon session details for correlation with other events
6. Check if the group creation aligns with authorized administrative activities or change management processes

Use PowerShell to efficiently query and analyze Event ID 4727 across multiple domain controllers for comprehensive monitoring.

1. Open PowerShell as Administrator on a domain controller or management workstation
2. Query recent group creation events:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4727} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message

3. Filter events by specific time range:

   $StartTime = (Get-Date).AddDays(-7)
   $EndTime = Get-Date
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4727; StartTime=$StartTime; EndTime=$EndTime}

4. Extract specific details from event messages:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4727} -MaxEvents 10 | ForEach-Object {
       $Event = [xml]$_.ToXml()
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           SubjectUserName = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
           TargetUserName = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'} | Select-Object -ExpandProperty '#text'
           TargetDomainName = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetDomainName'} | Select-Object -ExpandProperty '#text'
       }
   }

5. Export results for further analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4727} -MaxEvents 100 | Export-Csv -Path "C:\Temp\GroupCreationAudit.csv" -NoTypeInformation

Investigate the created group's current state and permissions to ensure it aligns with security policies and intended use.

1. Open Active Directory Users and Computers on a domain controller
2. Enable Advanced Features from the View menu to see all attributes
3. Locate the group mentioned in the Event ID 4727 entry
4. Right-click the group and select Properties
5. Review the General tab for basic group information and description
6. Check the Members tab to see if any users were immediately added to the group
7. Examine the Member Of tab to identify parent groups and inherited permissions
8. Review the Security tab to check explicit permissions assigned to the group
9. Use PowerShell to get detailed group information:

   Get-ADGroup -Identity "GroupName" -Properties * | Select-Object Name, SamAccountName, GroupScope, GroupCategory, Created, CreatedBy, Description, Members

10. Check group membership and nested relationships:

    Get-ADGroupMember -Identity "GroupName" -Recursive | Select-Object Name, ObjectClass, SamAccountName

Analyze related security events to build a complete timeline of activities surrounding the group creation and identify potential security implications.

1. Search for related events in the same timeframe using PowerShell:

   $GroupCreationTime = (Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4727} -MaxEvents 1).TimeCreated
   $StartTime = $GroupCreationTime.AddMinutes(-30)
   $EndTime = $GroupCreationTime.AddMinutes(30)
   
   # Look for group membership changes (4728, 4729, 4732, 4733)
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4728,4729,4732,4733; StartTime=$StartTime; EndTime=$EndTime}

2. Check for logon events from the same user who created the group:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625; StartTime=$StartTime; EndTime=$EndTime} | Where-Object {$_.Message -like "*SubjectUserName*"}

3. Look for privilege escalation events (4672) around the same time:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4672; StartTime=$StartTime; EndTime=$EndTime}

4. Search for object access events if the group was immediately used:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4656,4658,4663; StartTime=$StartTime; EndTime=$EndTime}

5. Create a comprehensive timeline report:

   $Events = @()
   $Events += Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4727,4728,4729,4732,4733,4624,4672; StartTime=$StartTime; EndTime=$EndTime}
   $Events | Sort-Object TimeCreated | Select-Object TimeCreated, Id, LevelDisplayName, @{Name='EventType';Expression={switch($_.Id){4727{'Group Created'};4728{'User Added to Group'};4729{'User Removed from Group'};4732{'User Added to Local Group'};4733{'User Removed from Local Group'};4624{'Logon'};4672{'Special Privileges'};default{'Other'}}}}, Message | Export-Csv -Path "C:\Temp\GroupCreationTimeline.csv"

Set up automated monitoring to detect and alert on unauthorized or suspicious group creation activities in real-time.

1. Create a scheduled task to monitor Event ID 4727 using PowerShell:

   # Create monitoring script
   $ScriptContent = @'
   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4727; StartTime=(Get-Date).AddHours(-1)} -ErrorAction SilentlyContinue
   if ($Events) {
       foreach ($Event in $Events) {
           $EventXML = [xml]$Event.ToXml()
           $Creator = $EventXML.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
           $GroupName = $EventXML.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'} | Select-Object -ExpandProperty '#text'
           
           # Send alert email or log to SIEM
           Write-EventLog -LogName Application -Source "GroupMonitor" -EventId 1001 -Message "New security group created: $GroupName by $Creator at $($Event.TimeCreated)"
       }
   }
   '@
   
   $ScriptContent | Out-File -FilePath "C:\Scripts\MonitorGroupCreation.ps1"

2. Register the script as a scheduled task:

   $Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-ExecutionPolicy Bypass -File C:\Scripts\MonitorGroupCreation.ps1"
   $Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Hours 1)
   $Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable
   Register-ScheduledTask -TaskName "MonitorGroupCreation" -Action $Action -Trigger $Trigger -Settings $Settings -User "SYSTEM"

3. Configure Windows Event Forwarding to centralize Event ID 4727 collection:
   • On collector server, run: wecutil qc
   • Create subscription configuration file for Event ID 4727
   • Deploy WinRM configuration to source domain controllers
4. Set up custom Event Viewer views for quick access:
   • Open Event Viewer → Custom Views
   • Create new custom view filtering for Event ID 4727
   • Save view as "Group Creation Monitoring"
5. Integrate with SIEM solutions by configuring log forwarding:

   # Example: Forward to Splunk Universal Forwarder
   $SplunkConfig = @"
   [WinEventLog://Security]
   disabled = 0
   whitelist = 4727
   index = windows_security
   "@
   $SplunkConfig | Out-File -FilePath "C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf" -Append