Windows: User Added to Highly Privileged Local/Directory Groups via net.exe or Add-LocalGroupMember

Flags net.exe or PowerShell commands adding users to privileged groups like Group Policy Creator Owners or Schema Admins.

FreeUnreviewedSigmahighv1

windows-user-added-to-highly-privileged-local-directory-groups-via-net-exe-or-ad-10fb649c

title: "Windows: User Added to Highly Privileged Local/Directory Groups via net.exe or Add-LocalGroupMember"
id: b20e67b1-8330-48f1-a844-59d4d7615b01
related:
  - id: ffa28e60-bdb1-46e0-9f82-05f7a61cc06e
    type: similar
  - id: ad720b90-25ad-43ff-9b5e-5c841facc8e5
    type: similar
  - id: 10fb649c-3600-4d37-b1e6-56ea90bb7e09
    type: derived
status: test
description: This rule identifies process execution where a user is added to highly privileged groups, specifically “Group Policy Creator Owners” or “Schema Admins,” using either net.exe with localgroup /add or PowerShell’s Add-LocalGroupMember. Adding users to these groups can enable privilege escalation and persistence by granting elevated permissions. It relies on Windows process creation telemetry with command-line arguments to match the relevant add-to-group patterns.
references:
  - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_add_user_privileged_group.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-02-23
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1098
logsource:
  category: process_creation
  product: windows
detection:
  selection_main:
    - CommandLine|contains|all:
        - "localgroup "
        - " /add"
    - CommandLine|contains|all:
        - "Add-LocalGroupMember "
        - " -Group "
  selection_group:
    CommandLine|contains:
      - Group Policy Creator Owners
      - Schema Admins
  condition: all of selection_*
falsepositives:
  - Administrative activity that must be investigated
level: high
license: DRL-1.1

What it detects

This rule identifies process execution where a user is added to highly privileged groups, specifically “Group Policy Creator Owners” or “Schema Admins,” using either net.exe with localgroup /add or PowerShell’s Add-LocalGroupMember. Adding users to these groups can enable privilege escalation and persistence by granting elevated permissions. It relies on Windows process creation telemetry with command-line arguments to match the relevant add-to-group patterns.

Known false positives

Administrative activity that must be investigated

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.