GroupMembers

Bypass User Account Control

Defense Evasion, Privilege Escalation

Monitor users in the local administrator group on system.

SELECT UserDomain, UserName, GroupName

• Mitre - Bypass User Account Control

Valid Accounts

Defense Evasion, Persistence, Privilege Escalation

Monitor for accounts that may have been created by an adversary for persistence.

SELECT UserDomain, UserName, GroupName

• Mitre - Valid Accounts

Account Manipulation

Credential Access

Monitor for modification of accounts in correlation with other suspicious activity.

SELECT UserDomain, UserName, GroupName

• Mitre - Account Manipulation

Accounts

• Unusual members of Administrators
• Unusual members of Power Users, Backup Operators, Remote Desktop Users, etc.