User Added to Local Administrators Group — Detection Rule

Detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember".

Read the full analysis on IntelFusions