All Detections

Remote local admin group enumeration via SharpHound

SIGMA Detection Rules@SIGMADetectionRules
updated Sep 6, 20254061

Detects scenarios where an attacker enumerates local administratos group on multiple hosts via SharpHound.

Sigma