CmdID

CmdID / PowerShell / Cmdlets / Get

Get-ADUser

Gets one or more Active Directory users. Windows Server PowerShell reference

From the Windows Server PowerShell reference 12 parameters 1 Sigma rule looks for it Its page in the reference

Opens CmdID with your command, read as PowerShell. It is read in your browser and sent nowhere.

Parameters

12 in the Windows Server PowerShell reference
-AuthTypeSpecifies the authentication method to use.
-CredentialSpecifies the user account credentials to use to perform this task.
-FilterSpecifies a query string that retrieves Active Directory objects.
-IdentitySpecifies an Active Directory user object by providing one of the following property values.
-LDAPFilterSpecifies an LDAP query string that is used to filter Active Directory objects.
-PartitionSpecifies the distinguished name of an Active Directory partition.
-Properties, -PropertySpecifies the properties of the output object to retrieve from the server.
-ResultPageSizeSpecifies the number of objects to include in one page for an Active Directory Domain Services query.
-ResultSetSizeSpecifies the maximum number of objects to return for an Active Directory Domain Services query.
-SearchBaseSpecifies an Active Directory path to search under.
-SearchScopeSpecifies the scope of an Active Directory search.
-ServerSpecifies the Active Directory Domain Services instance to connect to, by providing one of the following values for a corresponding domain name or directory server.

What looks for it

Sigma process creation rules that name Get-ADUser
mediumUser Discovery And Export Via Get-ADUser CmdletNasreddine Bencherchali (Nextron Systems)