Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet

Title: Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet
Status: test
Description:Detects suspicious reconnaissance command line activity on Windows systems using the PowerShell Get-LocalGroupMember Cmdlet
References:
  -https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-10
modified:None
Tags:

• -'attack.discovery'
• -'attack.t1087.001'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_cmdlet:
    CommandLine|contains: 'Get-LocalGroupMember '
  selection_group:
    CommandLine|contains:
      -'domain admins'
      -' administrator'
      -' administrateur'
      -'enterprise admins'
      -'Exchange Trusted Subsystem'
      -'Remote Desktop Users'
      -'Utilisateurs du Bureau à distance'
      -'Usuarios de escritorio remoto'

  condition:all of selection_*
Falsepositives:
  -Administrative activity
Level: medium