Windows PowerShell Recon Using Get-LocalGroupMember on Local/Well-Known Groups

Flags PowerShell Get-LocalGroupMember usage targeting notable local group names in process creation logs.

FreeUnreviewedSigmamediumv1

windows-powershell-recon-using-get-localgroupmember-on-local-well-known-groups-c8a180d6

title: Windows PowerShell Recon Using Get-LocalGroupMember on Local/Well-Known Groups
id: dc0dccfb-8165-4abf-a510-8b3754b894f0
related:
  - id: cef24b90-dddc-4ae1-a09a-8764872f69fc
    type: similar
  - id: c8a180d6-47a3-4345-a609-53f9c3d834fc
    type: derived
status: test
description: This rule flags PowerShell process creation where the command line includes the Get-LocalGroupMember cmdlet and references specific local or well-known group names. Attackers commonly use local group membership enumeration to map privileges and identify misconfigurations before attempting privilege escalation or lateral movement. It relies on Windows process creation telemetry and matches command-line strings for both the cmdlet and targeted group names.
references:
  - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_get_localgroup_member_recon.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-10
tags:
  - attack.discovery
  - attack.t1087.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmdlet:
    CommandLine|contains: "Get-LocalGroupMember "
  selection_group:
    CommandLine|contains:
      - domain admins
      - " administrator"
      - " administrateur"
      - enterprise admins
      - Exchange Trusted Subsystem
      - Remote Desktop Users
      - Utilisateurs du Bureau à distance
      - Usuarios de escritorio remoto
  condition: all of selection_*
falsepositives:
  - Administrative activity
level: medium
license: DRL-1.1

What it detects

This rule flags PowerShell process creation where the command line includes the Get-LocalGroupMember cmdlet and references specific local or well-known group names. Attackers commonly use local group membership enumeration to map privileges and identify misconfigurations before attempting privilege escalation or lateral movement. It relies on Windows process creation telemetry and matches command-line strings for both the cmdlet and targeted group names.

Known false positives

Administrative activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.