Detection of PowerShell Local Group Enumeration

The use of the Get-LocalGroup command via PowerShell or cmd.exe allows for the enumeration of local groups on a Windows endpoint. This activity is frequently observed during the discovery phase of an attack, where adversaries seek to understand local group memberships. By identifying these memberships, attackers can target specific privileged accounts to facilitate further compromise or privilege escalation. This detection focuses on monitoring process execution telemetry to identify this command line, which serves as a precursor to more malicious post-exploitation activities. Defenders should monitor for this command to identify unauthorized discovery attempts within their environment.

Impact

Successful execution of local group discovery allows attackers to map the security posture of an endpoint, identifying high-value targets for privilege escalation. This reconnaissance can lead to unauthorized account access, lateral movement, or system-wide compromise depending on the level of permissions discovered and subsequently targeted.

Recommendation

• Deploy the provided Sigma rule to your SIEM to monitor for Get-LocalGroup execution.
• Enable Sysmon Event ID 1 (Process Creation) and ensure full command-line arguments are captured in logs to support this detection.
• Baseline legitimate administrative activity within your environment to tune out automated scripts or authorized system management tools.