Local User Group Addition to Administrators or Remote Desktop Users
Detects the use of net.exe or net1.exe to add a local user account to the 'Administrators' or 'Remote Desktop Users' groups. This is a common technique used by attackers to gain persistent, elevated access or enable remote access to a compromised machine.
Microsoft Sentinel (KQL)
