User Added to Remote Desktop Users Group

Title: User Added to Remote Desktop Users Group
Status: test
Description:Detects addition of users to the local Remote Desktop Users group via "Net" or "Add-LocalGroupMember".
References:
  -https://www.microsoft.com/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021/
Author: Florian Roth (Nextron Systems)
Date: 2021-12-06
modified:2022-09-09
Tags:

• -'attack.initial-access'
• -'attack.persistence'
• -'attack.lateral-movement'
• -'attack.t1133'
• -'attack.t1136.001'
• -'attack.t1021.001'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_main:
    - CommandLine|contains|all:
      - 'localgroup '
      - ' /add'
    - CommandLine|contains|all:
      - 'Add-LocalGroupMember '
      - ' -Group '
  selection_group:
    CommandLine|contains:
      -'Remote Desktop Users'
      -'Utilisateurs du Bureau à distance'
      -'Usuarios de escritorio remoto'

  condition:all of selection_*
Falsepositives:
  -Administrative activity
Level: high