Cleanup with bloodyAD:
bloodyAD -d ootw.local --host 10.10.10.200 -u attacker.user -p 'Password123!' remove groupMember 'Workstation Admins' alice.wright
Cleanup with PowerShell:
Remove-ADGroupMember -Identity 'Workstation Admins' -Members 'alice.wright' -Confirm:$false
Primary events:
4728 - Member added to security-enabled global group
4732 - Member added to security-enabled local group
4756 - Member added to security-enabled universal group
Useful follow-up:
4672 - Special privileges assigned
4624 - New logon with new privilege
5136 - Directory object modified
Remediation:
- restrict who can modify privileged groups
- alert on all privileged group additions
- review delegated group management rights
- require change approval for privileged group membership
- remove stale nested group paths