# A security-enabled local group membership was enumerated -\> wbengine.exe

**URL:** <https://discuss.elastic.co/t/a-security-enabled-local-group-membership-was-enumerated-wbengine-exe/290550>\
**Category:** Elastic Security\
**Created:** [November 30, 2021, 11:26am UTC](https://discuss.elastic.co/t/a-security-enabled-local-group-membership-was-enumerated-wbengine-exe/290550 "2021-11-30T11:26:53Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Metro20357](https://avatars.discourse-cdn.com/v4/letter/m/3ec8ea/32.png) [@Metro20357](https://discuss.elastic.co/u/Metro20357)\
**Post date:** [November 30, 2021, 11:26am UTC](https://discuss.elastic.co/t/a-security-enabled-local-group-membership-was-enumerated-wbengine-exe/290550/1 "2021-11-30T11:26:53Z")

</div>

Hi all 🙂

I'm starting my adventure with Elstick and please be patient to Me 🙂  
I have such a case.I would like to know if there is anything to be afraid of 😑  
I got the message from Elastick: "A security-enabled local group membership was enumerated" -\> It's about -\> wbengine.exe file. This occurs on one of my server.  
The question is how can i know if it's a normal behavior or not.  
I would like to ask for valuable tips and any help from Your site 🙂

Message: "A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: XXX Account Domain: XYZ  
Logon ID: 0x3E7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x36fc Process Name: C:\Windows\System32\wbengine.exe"

{  
"\_id": "ItSub30BacWe7FLt0Nqi",  
"\_index": "winlogbeat-7.15.1-2021.11.02-000001",  
"\_score": "1",  
"\_type": "\_doc",  
"@timestamp": "2021-11-30T07:11:03.645Z",  
"agent": {  
"ephemeral\_id": "a9caa39c-b776-4ba6-91e3-6d5fe2dc8338",  
"hostname": "XXX",  
"id": "98d9d801-45cc-4386-aa2f-d2285ab46ba1",  
"name": "XXX",  
"type": "winlogbeat",  
"version": "7.15.1"  
},  
"ecs": {  
"version": "1.11.0"  
},  
"event": {  
"action": "File created (rule: FileCreate)",  
"category": "file",  
"code": "11",  
"created": "2021-11-30T07:11:05.334Z",  
"kind": "event",  
"module": "sysmon",  
"provider": "Microsoft-Windows-Sysmon",  
"type": "creation"  
},  
"file": {  
"directory": "C:\Users\XYZ\Desktop",  
"extension": "exe",  
"name": "wbengine.exe",  
"path": "C:\Users\XYZ\Desktop\wbengine.exe"  
},  
"host": {  
"architecture": "x86\_64",  
"hostname": "XXX",  
"id": "fab3cb5d-0876-4a2e-a797-830b010ca60d",  
"ip": "fe80::f103:8015:ed95:7ec5,10.255.200.24",  
"mac": "00:15:5d:c8:06:22",  
"name": "XYZ",  
"os": {  
"build": "17763.1879",  
"family": "windows",  
"kernel": "10.0.17763.1879 (WinBuild.160101.0800)",  
"name": "Windows Server 2019 Standard",  
"platform": "windows",  
"type": "windows",  
"version": "10.0"  
}  
},  
"log": {  
"level": "information"  
},  
"message": "File created:\nRuleName: EXE\nUtcTime: 2021-11-30 07:11:03.645\nProcessGuid: {fab3cb5d-c60d-61a5-69fe-030000000500}\nProcessId: 12752\nImage: C:\WINDOWS\Explorer.EXE\nTargetFilename: C:\Users\XYZ\Desktop\wbengine.exe\nCreationUtcTime: 2021-11-30 07:11:03.645\nUser: XYZ",  
"process": {  
"entity\_id": "{fab3cb5d-c60d-61a5-69fe-030000000500}",  
"executable": "C:\WINDOWS\Explorer.EXE",  
"name": "Explorer.EXE",  
"pid": "12752"  
},  
"rule": {  
"name": "EXE"  
},  
"winlog": {  
"api": "wineventlog",  
"channel": "Microsoft-Windows-Sysmon/Operational",  
"computer\_name": "XYZ",  
"event\_data": {  
"CreationUtcTime": "2021-11-30 07:11:03.645",  
"User": "XXX"  
},  
"event\_id": "11",  
"opcode": "Info",  
"process": {  
"pid": "11832",  
"thread": {  
"id": "276"  
}  
},  
"provider\_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",  
"provider\_name": "Microsoft-Windows-Sysmon",  
"record\_id": "18565",  
"task": "File created (rule: FileCreate)",  
"user": {  
"domain": "NT AUTHORITY",  
"identifier": "S-1-5-18",  
"name": "SYSTEM",  
"type": "User"  
},  
"version": "2"  
}  
}

 ![Elastick](https://us1.discourse-cdn.com/elastic/original/3X/6/0/60532173b6210aab2984f37d4118412d294eceef.png)

BR,

Luk 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 28, 2021, 11:27am UTC](https://discuss.elastic.co/t/a-security-enabled-local-group-membership-was-enumerated-wbengine-exe/290550/2 "2021-12-28T11:27:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.