Modification of Local Administrator Group

Ethan Anderson@ethan

•updated Jul 17, 2025•7•3•90

This rule detects attempts to modify the local Administrators group using the 'net localgroup administrators' command. This command is often used by adversaries to add users to the local administrators group for privilege escalation or persistence.