Investigate sensitive local group additions with SID resolve
detects manual additions to local Administrators, Remote Desktop Users, and Remote Management Users groups, resolving member SIDs to display names via AD sync, host inventory, and well-known SID mapping, with machine account and FQDN deduplication built in.
Cortex XDR
