All Detections

Add malicious user to Admins and RDP users group via PowerShell

Azure Sentinel@AzureSentinel
updated Jun 17, 2025027

Look for adding a user to Administrators in remote desktop users via PowerShell.

Microsoft Sentinel (KQL)