find os language independent users group by using the SID

2023-04-26 18:49:29 +02:00 · 2023-04-26 18:49:29 +02:00 · 03c8710605
commit 03c8710605
parent 379f9c450b
1 changed files with 4 additions and 1 deletions
--- a/windows-hardening/windows-local-privilege-escalation/com-hijacking.md
+++ b/windows-hardening/windows-local-privilege-escalation/com-hijacking.md
@ -45,7 +45,10 @@ foreach ($Task in $Tasks)
  {
    if ($Task.Triggers.Enabled -eq $true)
    {
-      if ($Task.Principal.GroupId -eq "Users")
+      $usersSid = "S-1-5-32-545"
+      $usersGroup = Get-LocalGroup | Where-Object { $_.SID -eq $usersSid }
+
+      if ($Task.Principal.GroupId -eq $usersGroup)
      {
        Write-Host "Task Name: " $Task.TaskName
        Write-Host "Task Path: " $Task.TaskPath