Local group enumeration via net localgroup or Get-LocalGroup

1title: Local group enumeration via net localgroup or Get-LocalGroup2id: 722bbce4-af36-43c4-a392-66bf5ef0408c3status: experimental4description: |5  Matches the Windows leg of AN0317: a process-creation event where net.exe or6  its net1.exe helper is invoked with the localgroup verb, or where the command7  line carries the Get-LocalGroup cmdlet family (Get-LocalGroup and8  Get-LocalGroupMember both satisfy the same substring). Both forms read only9  the SAM of the local machine, which is what keeps this rule inside T1069.00110  and out of T1069.002 — `net group` and Get-ADGroupMember read domain groups11  and are deliberately not matched here, because the parent T1069 was declined12  precisely for ORing the two together. The analytic's real signal is13  correlation, not the command: MITRE's TimeWindow knob asks for enumeration14  followed by lateral movement and its UserContext knob asks whether the caller15  is privileged, and lib/sigma models neither a timeframe nor an identity16  lookup, so a match means one enumeration command ran and nothing more. Three17  coverage limits are structural: the direct API route the analytic also names18  (NetLocalGroupEnum, NetLocalGroupGetMembers) writes no process event at all,19  a base64-encoded PowerShell command hides the cmdlet name from CommandLine,20  and matching net.exe on its image path misses a renamed copy. The brief maps21  Security EventID 4688 onto the Sysmon-shaped process_creation category, and22  this rule is written in the Sysmon EventID 1 vocabulary (Image, CommandLine);23  an estate feeding 4688 into the same category must map NewProcessName onto24  Image first, and must have both Audit Process Creation and the separate25  Include command line in process creation events policy enabled — neither is26  on by default, and without the second one CommandLine is absent and every27  selection here is dead.28  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0114, not hand-written and not tested by its author. Any lab result is on this rule's own page.29references:30  - https://attack.mitre.org/techniques/T1069/00131  - https://attack.mitre.org/detectionstrategies/DET011432author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)33date: 2026-08-1634tags:35  - attack.discovery36  - attack.t1069.00137logsource:38  category: process_creation39  product: windows40detection:41  selection_net_image:42    Image|endswith:43      - '\net.exe'44      - '\net1.exe'45  selection_localgroup_verb:46    CommandLine|contains: ' localgroup'47  selection_cmdlet:48    CommandLine|contains: 'Get-LocalGroup'49  condition: (selection_net_image and selection_localgroup_verb) or selection_cmdlet50falsepositives:51  - "Compliance, inventory and vulnerability scanners that enumerate the local Administrators group on every host at every scan — CIS and STIG baseline checks, SCCM configuration items and agent-based posture tools all do this on a fixed schedule, which makes them the highest-volume match by a wide margin and is why this rule is scored low rather than medium."52  - "Provisioning and logon scripts that add or remove accounts with net localgroup Administrators <user> /add, which matches the same localgroup substring as a read. Imaging task sequences, domain-join scripts and local-admin rotation tooling produce one or more hits per machine build."53  - "Helpdesk and desktop-support sessions, where net localgroup administrators is the standard first command when checking why a user cannot install software or elevate."54  - "Application installers and their prerequisite checks that verify the installing account is a local administrator, or that create and populate a product-specific local group, once per install and again at every upgrade."55level: low