User Added to Local Administrator Group
Detects when a user account is added to the local 'Administrators' group on a Windows system. This activity is critical for privilege escalation and persistence, as it grants the added user administrative rights. While it can be a legitimate administrative action, it is also a common technique used by attackers to maintain control and elevate privileges after initial compromise.
Sigma
