Get-WMIObject Win32_Group Discovery

The analytic detects the use of the `Get-WMIObject Win32_Group` command executed via PowerShell or cmd.exe to enumerate local groups on an endpoint. This activity is often a precursor to privilege escalation or lateral movement, as attackers map out group memberships to identify potential exploitation paths or unauthorized access to sensitive resources.