User Added to Remote Desktop Users Group

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•16

Detects the addition of users to the local 'Remote Desktop Users' group using either the 'net localgroup' command or the 'Add-LocalGroupMember' PowerShell cmdlet. This activity can indicate an adversary attempting to establish persistence or facilitate lateral movement via Remote Desktop Protocol.