Enumeration of Administrator Accounts

process where event.type in ("start", "process_started") and
(((process.name : "net.exe" or process.pe.original_file_name ==
"net.exe") or ((process.name : "net1.exe" or
process.pe.original_file_name == "net1.exe") and not
process.parent.name : "net.exe")) and process.args : ("group",
"user", "localgroup") and process.args : ("admin", "Domain Admins",
"Remote Desktop Users", "Enterprise Admins", "Organization
Management") and not process.args : "/add") or
((process.name : "wmic.exe" or process.pe.original_file_name ==
"wmic.exe") and process.args : ("group", "useraccount"))