Windows: User Added to Local Remote Desktop Users Group via Net or PowerShell

title: "Windows: User Added to Local Remote Desktop Users Group via Net or PowerShell"
id: 9dd4cd0e-a08a-450c-a813-a9e4b47a3107
related:
  - id: ad720b90-25ad-43ff-9b5e-5c841facc8e5
    type: similar
  - id: 10fb649c-3600-4d37-b1e6-56ea90bb7e09
    type: similar
  - id: ffa28e60-bdb1-46e0-9f82-05f7a61cc06e
    type: derived
status: test
description: This rule flags process executions that add an account to the local "Remote Desktop Users" group using either the net command ("localgroup" with "/add") or PowerShell ("Add-LocalGroupMember"). Adding users to this group can enable interactive remote access, increasing persistence and facilitating lateral movement. It relies on Windows process creation telemetry capturing command-line arguments that include the group name and the add operation.
references:
  - https://www.microsoft.com/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_add_user_remote_desktop_group.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-12-06
modified: 2022-09-09
tags:
  - attack.initial-access
  - attack.persistence
  - attack.lateral-movement
  - attack.t1133
  - attack.t1136.001
  - attack.t1021.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_main:
    - CommandLine|contains|all:
        - "localgroup "
        - " /add"
    - CommandLine|contains|all:
        - "Add-LocalGroupMember "
        - " -Group "
  selection_group:
    CommandLine|contains:
      - Remote Desktop Users
      - Utilisateurs du Bureau à distance
      - Usuarios de escritorio remoto
  condition: all of selection_*
falsepositives:
  - Administrative activity
level: high
license: DRL-1.1