Local admin group enumeration shortly after PsExec-originated session

Duo Tech@duotech

•updated Aug 5, 2026•3•0•6

Detects local Administrators group enumeration via net.exe or net1.exe within 10 minutes of a PsExec session on the same device. This behavior is indicative of post-compromise privilege or account discovery following remote service execution.