Local Admin Group Enumeration via Web Shell

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•2

This rule detects attempts to enumerate local administrator groups via a web shell. It specifically looks for HTTP requests containing the string "net localgroup" in the URI, which is a common command used to list local groups on a Windows system. The detection is case-insensitive and targets established HTTP connections from any source to the home network.