Local group enumeration via net localgroup or Get-LocalGroup

Siemphony@siemphonylowT1069.001verified in lab

Matches the Windows leg of AN0317: a process-creation event where net.exe or its net1.exe helper is invoked with the localgroup verb, or where the command line carries the Get-LocalGroup cmdlet family (Get-LocalGroup and Get-LocalGroupMember both satisfy the same substring). Both forms read only the SAM of the local machine, which is what keeps this rule inside T1069.001 and out of T1069.002 — `net group` and Get-ADGroupMember read domain groups and are deliberately not matched here, because the parent T1069 was declined precisely for ORing the two together. The analytic's real signal is correlation, not the command: MITRE's TimeWindow knob asks for enumeration followed by lateral movement and its UserContext knob asks whether the caller is privileged, and lib/sigma models neither a timeframe nor an identity lookup, so a match means one enumeration command ran and nothing more. Three coverage limits are structural: the direct API route the analytic also names (NetLocalGroupEnum, NetLocalGroupGetMembers) writes no process event at all, a base64-encoded PowerShell command hides the cmdlet name from CommandLine, and matching net.exe on its image path misses a renamed copy. The brief maps Security EventID 4688 onto the Sysmon-shaped process_creation category, and this rule is written in the Sysmon EventID 1 vocabulary (Image, CommandLine); an estate feeding 4688 into the same category must map NewProcessName onto Image first, and must have both Audit Process Creation and the separate Include command line in process creation events policy enabled — neither is on by default, and without the second one CommandLine is absent and every selection here is dead. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0114, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((FolderPath endswith "\\net.exe" or FolderPath endswith "\\net1.exe") and ProcessCommandLine contains " localgroup") or ProcessCommandLine contains "Get-LocalGroup")

Splunk · SPL

Run this as a search.

index=* (((Image="*\\net.exe" OR Image="*\\net1.exe") AND CommandLine="* localgroup*") OR CommandLine="*Get-LocalGroup*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.executable) LIKE "*\\\\net.exe" OR TO_LOWER(process.executable) LIKE "*\\\\net1.exe") AND TO_LOWER(process.command_line) LIKE "* localgroup*") OR TO_LOWER(process.command_line) LIKE "*get-localgroup*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\net\.exe$|\\net1\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i) localgroup</field>    <description>Local group enumeration via net localgroup or Get-LocalGroup (1/2)</description>    <mitre>      <id>T1069.001</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)Get-LocalGroup</field>    <description>Local group enumeration via net localgroup or Get-LocalGroup (2/2)</description>    <mitre>      <id>T1069.001</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: discovery_recon
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 722bbce4-af36-43c4-a392-66bf5ef0408c

ATT&CKT1069.001

T1069.001Local Groups

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondiscovery recon

discovery reconAI draft — unreviewed

01 · What this rule detects

A process-creation event where someone asks the local machine which groups exist and who is in them: net localgroup, or a Get-LocalGroup cmdlet. This is the Windows leg of AN0317. Both forms read only the local SAM, and that is what keeps the rule inside T1069.001 rather than drifting into T1069.002 — net group and Get-ADGroupMember read domain groups and are deliberately not matched. That split is not cosmetic: the parent technique T1069 was declined in this corpus precisely for ORing the two together into something that says nothing useful.

02 · Telemetry you need

category: process_creation, product: windows, copied from the brief. Read the prerequisite carefully, because it has two halves. The brief offers Security EventID 4688 and maps it onto this Sysmon-shaped category; the rule is written in the Sysmon EventID 1 vocabulary (Image, CommandLine), so an estate feeding 4688 must map NewProcessName onto Image before anything matches. And 4688 needs Audit Process Creation plus the separate Include command line in process creation events policy. Neither is on in a default install. Without the second, CommandLine is absent and every selection in this rule is dead while the rule still validates cleanly and returns zero rows.

03 · How the logic works

Three selections, condition (selection_net_image and selection_localgroup_verb) or selection_cmdlet. The first arm pairs Image|endswith on \net.exe and \net1.exe with CommandLine|contains: ' localgroup'. net1.exe is there because net.exe forwards most verbs to it, and on some invocations that helper is the process the event names. The leading space in ' localgroup' keeps it an argument rather than a substring of a path. The second arm is a bare CommandLine|contains: 'Get-LocalGroup', which catches both Get-LocalGroup and Get-LocalGroupMember on one substring. What the rule cannot do is the part the analytic actually cares about. MITRE's TimeWindow knob asks for enumeration followed by lateral movement, and its UserContext knob asks whether the caller is privileged. This Sigma dialect models neither a timeframe nor an identity lookup, so a match means one enumeration command ran and nothing more. Three further blind spots are structural: the direct API route the analytic names — NetLocalGroupEnum, NetLocalGroupGetMembers — writes no process event at all; base64-encoded PowerShell hides the cmdlet name from CommandLine; and matching net.exe by image path misses a renamed copy.

04 · Common false positives

Loudly and on a schedule, which is why the level is low. Compliance, inventory and vulnerability scanners enumerate the local Administrators group on every host at every scan — CIS and STIG checks, SCCM configuration items, agent-based posture tools. That is the highest-volume match by a wide margin. Provisioning and logon scripts that write groups with net localgroup Administrators <user> /add match the same substring as a read. Helpdesk staff run net localgroup administrators as their reflex first command. Installers check whether the account is a local admin, once per install and again at upgrade.

05 · Detection maturity

tier_1: Lowest tier. Derived from MITRE prose and never executed against a log line. Treat it as a hunt query, measure the volume yourself, and set the level from what you observe rather than from what is written here.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Exclude by identity and parent, not by command. Suppress your scanner's service account and your management agent as ParentImage, both pinned by full path. Then add the correlation the rule structurally lacks: pipe hits into a rule that requires a second discovery or lateral-movement event from the same host within minutes, which is MITRE's TimeWindow knob implemented outside Sigma. UserContext is best served by scoping alerts to non-admin and service accounts.

Declared by the author

Compliance, inventory and vulnerability scanners that enumerate the local Administrators group on every host at every scan — CIS and STIG baseline checks, SCCM configuration items and agent-based posture tools all do this on a fixed schedule, which makes them the highest-volume match by a wide margin and is why this rule is scored low rather than medium.
Provisioning and logon scripts that add or remove accounts with net localgroup Administrators <user> /add, which matches the same localgroup substring as a read. Imaging task sequences, domain-join scripts and local-admin rotation tooling produce one or more hits per machine build.
Helpdesk and desktop-support sessions, where net localgroup administrators is the standard first command when checking why a user cannot install software or elevate.
Application installers and their prerequisite checks that verify the installing account is a local administrator, or that create and populate a product-specific local group, once per install and again at every upgrade.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification2 runs

Verified in Siemphony lab

Security Datasets — Local administrators enumerated with net localgroup
passed
Siemphony IR · 3 Sept 2026
2 true · 0 false · 0.0% noise
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1069.001, evaluated against their process_creation events.

Share this rule

/u/siemphony/722bbce4-af36-43c4-a392-66bf5ef0408c

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Local group enumeration via net localgroup or Get-LocalGroup

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it