LoFP LoFP / administrative activity that must be investigated

Techniques

Sample rules

User Added To Highly Privileged Group

Description

Detects addition of users to highly privileged groups via “Net” or “Add-LocalGroupMember”.

Detection logic

condition: all of selection_*
selection_group:
  CommandLine|contains:
  - Group Policy Creator Owners
  - Schema Admins
selection_main:
- CommandLine|contains|all:
  - 'localgroup '
  - ' /add'
- CommandLine|contains|all:
  - 'Add-LocalGroupMember '
  - ' -Group '