User Added To Highly Privileged Group

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•0•2

Detects addition of users to highly privileged groups via "Net" or "Add-LocalGroupMember".