CmdID / PowerShell / Cmdlets / Get
Get-LocalGroupMember
Gets members from a local group. PowerShell reference
From the PowerShell reference
4 parameters
Alias glgm
1 Sigma rule looks for it
What it does
Gets members from a local group. The Get-LocalGroupMember cmdlet gets members from a local group. NOTE: The Microsoft.PowerShell.LocalAccounts module is not available in 32-bit PowerShell on a 64-bit system.
Get-LocalGroupMember [[-Member] <String>] [-Name] <String> [<CommonParameters>]Get-LocalGroupMember [-Group] <LocalGroup> [[-Member] <String>] [<CommonParameters>]Get-LocalGroupMember [[-Member] <String>] [-SID] <SecurityIdentifier> [<CommonParameters>]Get all members of the Administrators group
Get-LocalGroupMember -Group "Administrators"IdentifyIts page in the reference: Get-LocalGroupMember.
Parameters
-GroupSpecifies the security group from which this cmdlet gets members.-MemberSpecifies a user or group that this cmdlet gets from a security group. You can specify users or groups by name or security ID (SID). Specify SID strings in S-R-I-S-S . . . format. You can use wildcard characters. If you do not specify this parameter, the cmdlet gets all members of the group.-NameSpecifies the name of the security group from which this cmdlet gets members.-SIDSpecifies the security ID of the security group from which this cmdlet gets members.What looks for it
mediumSuspicious Reconnaissance Activity Using Get-LocalGroupMember CmdletNasreddine Bencherchali (Nextron Systems)