User Added to Local Administrators Group

Title: User Added to Local Administrators Group
Status: test
Description:Detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember".
References:
  -https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-12
modified:2023-03-02
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.t1098'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_main:
    - CommandLine|contains|all:
      - 'localgroup '
      - ' /add'
    - CommandLine|contains|all:
      - 'Add-LocalGroupMember '
      - ' -Group '
  selection_group:
    CommandLine|contains:
      -' administrators '
      -' administrateur'

  condition:all of selection_*
Falsepositives:
  -Administrative activity
Level: medium