CmdID

CmdID / PowerShell / Cmdlets / New

New-ADGroup

Creates an Active Directory group. Windows Server PowerShell reference

From the Windows Server PowerShell reference 17 parameters 1 Sigma rule looks for it Its page in the reference

Opens CmdID with your command, read as PowerShell. It is read in your browser and sent nowhere.

Parameters

17 in the Windows Server PowerShell reference
Show its 17 parameters
-AuthTypeSpecifies the authentication method to use.
-Confirm, -cfPrompts you for confirmation before running the cmdlet.
-CredentialSpecifies the user account credentials to use to perform this task.
-DescriptionSpecifies a description of the object.
-DisplayNameSpecifies the display name of the object.
-GroupCategorySpecifies the category of the group.
-GroupScopeSpecifies the group scope of the group.
-HomePageSpecifies the URL of the home page of the object.
-InstanceSpecifies an instance of a group object to use as a template for a new group object.
-ManagedBySpecifies the user or group that manages the object by providing one of the following property values.
-NameSpecifies the name of the object.
-OtherAttributesSpecifies object attribute values for attributes that are not represented by cmdlet parameters.
-PassThruReturns an object representing the item with which you are working.
-PathSpecifies the X.500 path of the Organizational Unit (OU) or container where the new object is created.
-SamAccountNameSpecifies the Security Account Manager (SAM) account name of the user, group, computer, or service account.
-ServerSpecifies the Active Directory Domain Services instance to connect to, by providing one of the following values for a corresponding domain name or directory server.
-WhatIf, -wiShows what would happen if the cmdlet runs.

What looks for it

Sigma process creation rules that name New-ADGroup
highPotential Exploitation of CVE-2024-37085 - Suspicious Creation Of ESX Admins Groupfrack113