Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects suspicious reconnaissance command line activity on Windows systems using the PowerShell Get-LocalGroupMember Cmdlet to enumerate local group memberships, specifically looking for common administrative or privileged groups. This activity is often performed by attackers during the discovery phase to identify potential privilege escalation paths or valuable targets.