Security Enabled Global Group Member Removed · win.system.eventID = 633$|^4729

Description

field win.system.eventID="^633$|^4729$"

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

1. 60000 Group of windows rules. anchor level 0
   decoded_as=windows_eventchannel AND field win.system.providerName="\.+"
2. 60001 Group of Windows rules for the security channel. anchor level 0
   field win.system.channel="^Security$"
3. 60103 Windows audit success event anchor level 0
   field win.system.severityValue="^AUDIT_SUCCESS$|^success$"
4. 60113 Group Account Changed anchor level 5
   field win.system.eventID="^632$|^4728$|^633$|^4729$|^636$|^4732$|^637$|^4733$|^639$|^4735$| |^641$|^4737$|^637$|^4733$|^659$|^4755$|^660$|^4766$|^668$|^4764$| |^649$|^4745$|^650$|^4746$|^651$|^4747$|^654$|^4750$|^655$|^4751$| |^656$|^4752$|^659$|^4755$|^660$|^4756$|^661$|^4757$|^664$|^4760$| |^665$|^4761$|^666$|^4762$"
5. 60142 Security Enabled Global Group Member Removed · win.system.eventID = 633$|^4729 anchor level 5 this rule
   field win.system.eventID="^633$|^4729$"

Rule dependencies

Depends on

• composes · Wazuh if_sid 60113
  • Group Account Changed