User Added to Local Administrators Group

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•15

This rule detects when a user is added to the local Administrators group on a Windows system. It specifically looks for command-line executions of 'net.exe' with 'localgroup <groupname> /add' or 'powershell.exe' with 'Add-LocalGroupMember -Group <groupname>', where the group name contains 'administrators' or 'administrateur'. This activity is often associated with privilege escalation or persistence techniques by adversaries.