All Detections

User Added to Local Administrators Group

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 202504

Detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember".

Sigma