CmdID

CmdID / PowerShell / Cmdlets / Get

Get-DomainController

Use the Get-DomainController cmdlet to view a list of domain controllers that exist in your organization. Exchange PowerShell reference

From the Exchange PowerShell reference 4 parameters 1 Sigma rule looks for it Its page in the reference

Opens CmdID with your command, read as PowerShell. It is read in your browser and sent nowhere.

Parameters

4 in the Exchange PowerShell reference
-GlobalCatalogThe GlobalCatalog switch specifies whether the command should return a list of global catalog servers.
-CredentialThe Credential parameter specifies the username and password that's used to run this command.
-DomainNameThe DomainName parameter specifies the fully qualified domain name (FQDN) of the domain for which you want to return a list of domain controllers.
-ForestThe Forest parameter specifies the FQDN of the root domain of the forest for which you want to return a list of domain controllers.

What looks for it

Sigma process creation rules that name Get-DomainController
highHackTool - SharpView Executionfrack113