Windows: User Added to Local Administrators Group via Net or Add-LocalGroupMember
Flags Windows command lines that add a user to the local administrators group via net.exe or Add-LocalGroupMember.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-12
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies attempts to add a user to the local administrators group on Windows using either net.exe (localgroup ... /add) or PowerShell’s Add-LocalGroupMember. Adding accounts to local administrators enables immediate privilege escalation and can establish persistence even without exploiting a vulnerability. It relies on process creation telemetry and matches specific command-line substrings indicating the target group and administrative add action.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: User Added to Local Administrators Group via Net or Add-LocalGroupMember"
id: 0169e833-1f9b-48e3-8f76-09004384eeff
related:
- id: ffa28e60-bdb1-46e0-9f82-05f7a61cc06e
type: similar
- id: 10fb649c-3600-4d37-b1e6-56ea90bb7e09
type: similar
- id: ad720b90-25ad-43ff-9b5e-5c841facc8e5
type: derived
status: test
description: This rule identifies attempts to add a user to the local administrators group on Windows using either net.exe (localgroup ... /add) or PowerShell’s Add-LocalGroupMember. Adding accounts to local administrators enables immediate privilege escalation and can establish persistence even without exploiting a vulnerability. It relies on process creation telemetry and matches specific command-line substrings indicating the target group and administrative add action.
references:
- https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_add_user_local_admin_group.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-12
modified: 2023-03-02
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1098
logsource:
category: process_creation
product: windows
detection:
selection_main:
- CommandLine|contains|all:
- "localgroup "
- " /add"
- CommandLine|contains|all:
- "Add-LocalGroupMember "
- " -Group "
selection_group:
CommandLine|contains:
- " administrators "
- " administrateur"
condition: all of selection_*
falsepositives:
- Administrative activity
level: medium
license: DRL-1.1