All Detections

User Added to Remote Desktop Users Group

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 2025018

Detects addition of users to the local Remote Desktop Users group via "Net" or "Add-LocalGroupMember".

Sigma