Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet

SigmaHQ Detections@sigmaHQ

•updated Nov 24, 2025•0•0•1

Detects suspicious reconnaissance command line activity on Windows systems using the PowerShell Get-LocalGroupMember Cmdlet