XQL Query - look for any local administrator account on endpoint

[elzahy]

Hi,

I would like to create Cortex XQL query that can let me to have a list of local administrator account on endpoint (Windows)., it is possible? 

Thank you. 

[eluis · Accepted solution]

Hi Elzahy, 

Please let me give you a link that might bring some light to your purpose. There was another discuss some weeks ago: 

https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/user-added-to-local-administrators-group...

Please let me know if this solves your use case.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR, 

Luis