User Added to Local Administrators Group

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•0•0

Detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember".