Detects addition of users to highly privileged groups via "Net" or "Add-LocalGroupMember".
Read the full analysis on IntelFusions