[WINDOWS-SECURITY] net group domain controllers command executed

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-SECURITY] net group domain controllers command executed"; program:*Security*
| *Sysmon*; event_id:1,4688; content:"net group"; nocase; content:"domain controllers"; reference:url,thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/; classtype:trojan-activity; sid:5013889; rev:1; metadata:deployment Endpoint,affected_product NONE,affected_version NONE,mitigation NONE,deprecation_reason NONE,tag NONE, created_at 2023_02_01, updated_at 2023_02_01, mitre_tactic_id TA0007, mitre_technique_id T1069;)