## Use Case 4: Privilege Escalation (Medium)

**Scenario**: An attacker has gained access to a standard user account ("Bob"). Now they want to become an Administrator to install rootkits, dump passwords, or delete backups. This technique is **Privilege Escalation**.

### The Logic
Standard users should not be added to high-privilege groups. Administrative group formatting changes are rare and sensitive.

### 1. The Data Sources
*   **Source**: Windows Security Event Logs (Active Directory Domain Controller).
*   **Key Fields**:
    *   `Event ID`: **4728** (Member added to security-enabled global group), **4732** (Member added to security-enabled local group), **4756** (Member added to security-enabled universal group).
    *   `Target Account`: The user being promoted (e.g., "Bob").
    *   `Target Group`: The group being modified (e.g., "Domain Admins", "Enterprise Admins", "Schema Admins").
    *   `Subject Account`: The user *doing* the adding (who made the change?).

### 2. The Pattern
*   Any addition to highly sensitive groups (Domain Admins) should be flagged.
*   Frequent failures to add users to groups (Event 4728 failures) might indicate an attacker guessing permissions.

### 3. The SIEM Rule (Pseudocode)
```sql
Alert IF:
    Event_ID IN (4728, 4732, 4756)
    AND
    Target_Group IN ("Domain Admins", "Administrators", "Enterprise Admins")
```

### 4. Investigation Steps (The Playbook)
1.  **Verify the Change Request**: Check the ticketing system (Jira/ServiceNow). Is there an approved ticket to make Bob an Admin?
2.  **Check the Executor**: Who added Bob?
    *   Was it a known Admin account?
    *   Was it a Service Account? (Suspicious).
    *   Was it Bob adding himself? (High Confidence Compromise).
3.  **Time Context**:
    *   Was this done at 3:00 AM on a Saturday? (Suspicious).
    *   Was it done during business hours? (More likely legitimate).

### 5. False Positives
*   Legitimate IT operations. New Sysadmin hired, added to groups.
*   Automated provisioning scripts (e.g., Identity Management systems) rotating memberships.

### 6. Real World Risk
If an attacker reaches "Domain Admin", it is typically "Game Over". They can access every computer in the company, decrypt all passwords, and even create "Golden Tickets" to maintain access forever, even if you reset their password. Speed of detection here is critical.