Suspicious Get Local Groups Information - PowerShell (fa6a5a45-3ee2-4529-aa14-ee5edc9e29cb)
Detects the use of PowerShell modules and cmdlets to gather local group information. Adversaries may use local system permission groups to determine which groups exist and which users belong to a particular group such as the local administrators group.