User Added to Default Privileged Windows Security Groups

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index


This package is designed to capture the activity surrounding the execution of command line arguments that add a user to default privileged Windows Security Groups (local and domain).

Attribute Value
Type Hunting Query
Solution Intel471
ID b6365ad5-0ccd-4426-97bc-b9484eb9579f
Tactics DefenseEvasion, InitialAccess, Persistence, PrivilegeEscalation
Techniques T1078.003, T1136.002
Required Connectors SecurityEvents, WindowsSecurityEvents
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Selection Criteria Transformations Ingestion API Lake-Only
SecurityEvent CommandLine has_any "Administrators"
CommandLine has_any "group"
✓ ✓ ✓

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Hunting Queries · Back to Intel471