CmdID

CmdID / PowerShell / Cmdlets / Get

Get-Recipient

Use the Get-Recipient cmdlet to view existing recipient objects in your organization. Exchange PowerShell reference

From the Exchange PowerShell reference 22 parameters 1 Sigma rule looks for it Its page in the reference

Opens CmdID with your command, read as PowerShell. It is read in your browser and sent nowhere.

Parameters

22 in the Exchange PowerShell reference
Show its 22 parameters
-IdentityThe Identity parameter specifies the recipient object that you want to view.
-AnrThe Anr parameter specifies a string on which to perform an ambiguous name resolution (ANR) search.
-AuthenticationTypeThe AuthenticationType parameter specifies the recipient by authentication type.
-BookmarkDisplayNameThis parameter is reserved for internal Microsoft use.
-CapabilitiesThis parameter is reserved for internal Microsoft use.
-CredentialThe Credential parameter specifies the username and password that's used to run this command.
-DatabaseThe Database parameter return all recipients stored on the specified mailbox database.
-DomainControllerThe DomainController parameter specifies the domain controller that's used by this cmdlet to read data from or write data to Active Directory.
-FilterThe Filter parameter uses OPATH syntax to filter the results by the specified properties and values.
-IgnoreDefaultScopeThe IgnoreDefaultScope switch tells the command to ignore the default recipient scope setting for the Exchange PowerShell session, and to use the entire forest as the scope.
-IncludeBookmarkObjectThis parameter is reserved for internal Microsoft use.
-IncludeManagerWithDisplayName
-IncludeSoftDeletedRecipientsThe IncludeSoftDeletedRecipients switch specifies whether to include soft deleted recipients in the results.
-OrganizationalUnitThe OrganizationalUnit parameter filters the results based on the object's location in Active Directory.
-PropertiesThis parameter is reserved for internal Microsoft use.
-PropertySetThis parameter is reserved for internal Microsoft use.
-ReadFromDomainControllerThe ReadFromDomainController switch specifies that information should be read from a domain controller in the user's domain.
-RecipientPreviewFilterThe RecipientPreviewFilter parameter tests a recipient filter that you would use in a dynamic distribution group, address list, or email address policy.
-RecipientTypeThe RecipientType parameter filters the results by the specified recipient type.
-RecipientTypeDetailsThe RecipientTypeDetails parameter filters the results by the specified recipient subtype.
-ResultSizeThe ResultSize parameter specifies the maximum number of results to return.
-SortByThe SortBy parameter specifies the property to sort the results by.

What looks for it

Sigma process creation rules that name Get-Recipient
highEmail Exifiltration Via PowershellNasreddine Bencherchali (Nextron Systems), Azure-Sentinel (idea)