Suspicious Get Local Groups Information (cef24b90-dddc-4ae1-a09a-8764872f69fc)
Detects the use of PowerShell modules and cmdlets to gather local group information. Adversaries may use local system permission groups to determine which groups exist and which users belong to a particular group such as the local administrators group.