Suspicious User Added to Local Administrators Group (via process_creation)

title: Suspicious User Added to Local Administrators Group (via process_creation)
id: b87d90b4-5e7d-55b6-b5d4-743c447b1063
status: stable
description: This rule detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember".
references:
    - https://attack.mitre.org/techniques/T1098/
    - https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1
author: Huntrule Team
date: 2026-07-26
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1098
logsource:
    category: process_creation
    product: windows
detection:
    selection_main:
        - CommandLine|contains|all:
              - 'localgroup '
              - ' /add'
        - CommandLine|contains|all:
              - 'Add-LocalGroupMember '
              - ' -Group '
    selection_group:
        CommandLine|contains:
            - ' administrators '
            - ' administrateur'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium