win_lsa_server_normal_user_admin

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•23

Detect standard users login that are part of high privileged groups such as the Administrator group