User added to local administrator group using a PowerShell command

Adding a new user to the local admin group may or may not be malicious, but it is an outstanding action worth considering, as it shouldn't happen too often. A malware may add a new malicious user to the administrators group as a way of maintaining high privileges after the system was compromised.

Module:

Platform Analytics

Agent event type:

Process execution

Category:

Persistence

Status:

Enabled