Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet — Detection Rule

Detects suspicious reconnaissance command line activity on Windows systems using the PowerShell Get-LocalGroupMember Cmdlet

Read the full analysis on IntelFusions