User Added to Local Administrator Group

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects the addition of a new member to the local administrator group, which could be legitimate activity or a sign of privilege escalation activity