Reference to Administrator Group SID via PowerShell Script

Tim P@bobbyTablez

•updated Jul 23, 2025•3•3•44

The SID S-1-5-32-544 refers to the builtin "Administrators" group on a local Windows machine. Threat actors will often reference this SID rather than the group name in order to obfuscate their actions. References to the SID rather than the group name should be considered unusual.