Suspicious Local Group Information Discovery via PowerShell

SigmaHQ Detections@sigmaHQ

•updated Oct 1, 2025•0•17

Detects the use of PowerShell cmdlets (`Get-LocalGroup`, `Get-LocalGroupMember`) or WMI queries (`Get-WmiObject`, `Get-CimInstance` targeting `Win32_Group`) to gather local group information. Adversaries commonly use these methods to discover local system permission groups and identify users with elevated privileges, such as local administrators.