Add malicious user to Admins and RDP users group via PowerShell.yaml

id: 44a201c4-502a-4b75-871e-a2dc7f6d2e98
name: Add malicious user to Admins and RDP users group via PowerShell
description: |
  Look for adding a user to Administrators in remote desktop users via PowerShell.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Persistence
query: |   
  DeviceProcessEvents 
  | where InitiatingProcessFileName =~ 'powershell.exe' 
  | where InitiatingProcessCommandLine has_all('$admins=', 'System.Security.Principal.SecurityIdentifier', 'Translate', '-split', 'localgroup', '/add', '$rdp=')