cscli scenarios install sigmahq/proc_creation_win_susp_add_user_remote_desktop_group1type: trigger2name: sigmahq/proc_creation_win_susp_add_user_remote_desktop_group3description: |4 Detects addition of users to the local Remote Desktop Users group via "Net" or "Add-LocalGroupMember".5filter: |6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && ((evt.Parsed.CommandLine contains 'localgroup ' && evt.Parsed.CommandLine contains ' /add' || evt.Parsed.CommandLine contains 'Add-LocalGroupMember ' && evt.Parsed.CommandLine contains ' -Group ') && (evt.Parsed.CommandLine contains 'Remote Desktop Users' || evt.Parsed.CommandLine contains 'Utilisateurs du Bureau à distance' || evt.Parsed.CommandLine contains 'Usuarios de escritorio remoto'))7blackhole: 2m8#status: test9labels:10 service: windows11 confidence: 112 spoofable: 013 classification:14 - attack.t113315 - attack.t1136.00116 - attack.t1021.0011718 label: "User Added to Remote Desktop Users Group"19 behavior : "windows:audit"20 remediation: false2122scope:23 type: ParentProcessId24 expression: evt.Parsed.ParentProcessId2526