value: admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to list local groups: net localgroup administrator >> %temp%\download 
name: Permission Groups Discovery: Local Groups