Windows Event ID 4756 — Member Added to Universal Security Group
Logged when an account is added to a universal security group in Active Directory.
MITRE ATT&CK
Technique
T1098 · Account Manipulation
Tactic
Persistence
Why It Matters
Universal groups can span domains in a forest, making additions to privileged universal groups (e.g., Enterprise Admins) forest-wide in impact.
Key Fields
Group NameThe target group
Member Account NameWho was added
Subject Account NameWho performed the addition
Investigation Tips
- 1.Treat like 4728 for Enterprise Admins or other privileged universal groups.
- 2.Verify against change control records.
Related Event IDs
See Event ID 4756 in your logs
Upload a Windows Event Log (.evtx) file — EventPeeker automatically detects member added to universal security group patterns, maps findings to MITRE ATT&CK, and generates an AI triage report.
Analyze EVTX Logs Free →