Windows PowerShell Recon Using Get-LocalGroupMember on Local/Well-Known Groups
Flags PowerShell Get-LocalGroupMember usage targeting notable local group names in process creation logs.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-10-10
- Updated
- 2026-07-30
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell process creation where the command line includes the Get-LocalGroupMember cmdlet and references specific local or well-known group names. Attackers commonly use local group membership enumeration to map privileges and identify misconfigurations before attempting privilege escalation or lateral movement. It relies on Windows process creation telemetry and matches command-line strings for both the cmdlet and targeted group names.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PowerShell Recon Using Get-LocalGroupMember on Local/Well-Known Groups
id: dc0dccfb-8165-4abf-a510-8b3754b894f0
related:
- id: cef24b90-dddc-4ae1-a09a-8764872f69fc
type: similar
- id: c8a180d6-47a3-4345-a609-53f9c3d834fc
type: derived
status: test
description: This rule flags PowerShell process creation where the command line includes the Get-LocalGroupMember cmdlet and references specific local or well-known group names. Attackers commonly use local group membership enumeration to map privileges and identify misconfigurations before attempting privilege escalation or lateral movement. It relies on Windows process creation telemetry and matches command-line strings for both the cmdlet and targeted group names.
references:
- https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_get_localgroup_member_recon.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-10
tags:
- attack.discovery
- attack.t1087.001
logsource:
category: process_creation
product: windows
detection:
selection_cmdlet:
CommandLine|contains: "Get-LocalGroupMember "
selection_group:
CommandLine|contains:
- domain admins
- " administrator"
- " administrateur"
- enterprise admins
- Exchange Trusted Subsystem
- Remote Desktop Users
- Utilisateurs du Bureau à distance
- Usuarios de escritorio remoto
condition: all of selection_*
falsepositives:
- Administrative activity
level: medium
license: DRL-1.1