User Added to Remote Desktop Users Group — Detection Rule

Detects addition of users to the local Remote Desktop Users group via "Net" or "Add-LocalGroupMember".

Read the full analysis on IntelFusions