huntrule

Windows: User Added to Local Administrators Group via Net or Add-LocalGroupMember

Flags Windows command lines that add a user to the local administrators group via net.exe or Add-LocalGroupMember.

FreeUnreviewedSigmamediumv1
title: "Windows: User Added to Local Administrators Group via Net or Add-LocalGroupMember"
id: 0169e833-1f9b-48e3-8f76-09004384eeff
related:
  - id: ffa28e60-bdb1-46e0-9f82-05f7a61cc06e
    type: similar
  - id: 10fb649c-3600-4d37-b1e6-56ea90bb7e09
    type: similar
  - id: ad720b90-25ad-43ff-9b5e-5c841facc8e5
    type: derived
status: test
description: This rule identifies attempts to add a user to the local administrators group on Windows using either net.exe (localgroup ... /add) or PowerShell’s Add-LocalGroupMember. Adding accounts to local administrators enables immediate privilege escalation and can establish persistence even without exploiting a vulnerability. It relies on process creation telemetry and matches specific command-line substrings indicating the target group and administrative add action.
references:
  - https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_add_user_local_admin_group.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-12
modified: 2023-03-02
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1098
logsource:
  category: process_creation
  product: windows
detection:
  selection_main:
    - CommandLine|contains|all:
        - "localgroup "
        - " /add"
    - CommandLine|contains|all:
        - "Add-LocalGroupMember "
        - " -Group "
  selection_group:
    CommandLine|contains:
      - " administrators "
      - " administrateur"
  condition: all of selection_*
falsepositives:
  - Administrative activity
level: medium
license: DRL-1.1

What it detects

This rule identifies attempts to add a user to the local administrators group on Windows using either net.exe (localgroup ... /add) or PowerShell’s Add-LocalGroupMember. Adding accounts to local administrators enables immediate privilege escalation and can establish persistence even without exploiting a vulnerability. It relies on process creation telemetry and matches specific command-line substrings indicating the target group and administrative add action.

Known false positives

  • Administrative activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.