Investigate Windows process execution logs for a PowerShell cmdlet used to list group members. Look for entries where a group name is provided after a '-Name' flag and identify which group was queried.

DeviceProcessEvents | where ProcessCommandLine contains '-Name' | extend GroupName = tostring(split(ProcessCommandLine, '-Name ')[1]) | project GroupName, DeviceName, TimeGenerated

DeviceProcessEvents
| where ProcessCommandLine has_any ('powershell', 'pwsh')
    and (ProcessCommandLine has 'Get-ADGroupMember' or ProcessCommandLine has 'Get-LocalGroupMember')
    and ProcessCommandLine has '-Name'
| extend QueriedGroup = extract("-Name ['\"]*([^'\" ]+)['\"]*", 1, ProcessCommandLine)
| where isnotempty(QueriedGroup)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessAccountName, ProcessCommandLine, QueriedGroup

DeviceProcessEvents
| where ProcessCommandLine has "-Name"
  and (ProcessCommandLine has "Get-LocalGroupMember" or ProcessCommandLine has "Get-ADGroupMember" or ProcessCommandLine has "Get-GroupMember" or ProcessCommandLine has "Get-Group")
| extend GroupName = extract("-Name\\s+['\"]?([\\w\\d\\\\._-]+)['\"]?", 1, ProcessCommandLine)
| where isnotempty(GroupName)
| project TimeGenerated, DeviceName, AccountName, ProcessCreationTime, ProcessCommandLine, GroupName
| order by TimeGenerated desc

DeviceProcessEvents
| where ProcessCommandLine has "-Name"
| extend GroupName = extract("-Name\\s+(['\"]?)(.*?)(['\"]?\\s|$)", 2, ProcessCommandLine)
| where isnotempty(GroupName)
| project TimeGenerated, AccountName, DeviceName, ProcessCommandLine, GroupName

DeviceProcessEvents
| where FileName in~ ("powershell.exe", "pwsh.exe", "powershell_ise.exe")
| where ProcessCommandLine has_any ("Get-LocalGroupMember","Get-ADGroupMember","Get-DistributionGroupMember","Get-AzureADGroupMember","Get-MgGroupMember","Get-LocalGroup")
| where ProcessCommandLine has "-Name"
| extend GroupName = coalesce(
    extract(@'(?i)-name\s*(?::|=)?\s*"([^"]+)"', 1, ProcessCommandLine),
    extract(@'(?i)-name\s*(?::|=)?\s*''([^'']+)''', 1, ProcessCommandLine),
    extract(@'(?i)-name\s*(?::|=)?\s*([^\s\|\;]+)', 1, ProcessCommandLine)
)
| where isnotempty(GroupName)
| extend Cmdlet = case(
    ProcessCommandLine matches regex @'(?i)\bGet-LocalGroupMember\b', 'Get-LocalGroupMember',
    ProcessCommandLine matches regex @'(?i)\bGet-ADGroupMember\b', 'Get-ADGroupMember',
    ProcessCommandLine matches regex @'(?i)\bGet-AzureADGroupMember\b', 'Get-AzureADGroupMember',
    ProcessCommandLine matches regex @'(?i)\bGet-DistributionGroupMember\b', 'Get-DistributionGroupMember',
    ProcessCommandLine matches regex @'(?i)\bGet-MgGroupMember\b', 'Get-MgGroupMember',
    ProcessCommandLine matches regex @'(?i)\bGet-LocalGroup\b', 'Get-LocalGroup',
    'Unknown')
| project TimeGenerated, DeviceName, AccountDomain, AccountName, FileName, Cmdlet, GroupName, ProcessCommandLine, InitiatingProcessParentFileName, InitiatingProcessAccountDomain, InitiatingProcessAccountName
| order by TimeGenerated desc

let nameRegex = @"(?i)(?:-Name|-Identity)\s+(?:'([^']+)'|""([^""]+)""|([^\s)]+))";
union DeviceProcessEvents, DeviceEvents
| extend CmdLine = coalesce(ProcessCommandLine, InitiatingProcessCommandLine)
| where isnotempty(CmdLine)
// focus on likely PowerShell usage or explicit cmdlet mentions
| where CmdLine has_any ("Get-ADGroupMember","Get-LocalGroupMember","Get-ADGroup","Get-ADPrincipalGroupMembership","Get-LocalGroup","Get-GroupMember")
    or CmdLine has_any ("powershell.exe","pwsh.exe","PowerShell_ISE.exe")
// capture the cmdlet if present
| extend Cmdlet = extract(@"(?i)\b(Get-ADGroupMember|Get-LocalGroupMember|Get-ADGroup|Get-ADPrincipalGroupMembership|Get-LocalGroup|Get-GroupMember)\b", 1, CmdLine)
// extract group name after -Name or -Identity (handles 'quoted', ""double-quoted"", and unquoted tokens)
| extend g1 = extract(nameRegex, 1, CmdLine), g2 = extract(nameRegex, 2, CmdLine), g3 = extract(nameRegex, 3, CmdLine)
| extend GroupName = coalesce(g1, g2, g3)
| where isnotempty(GroupName)
| project TimeGenerated, DeviceName, DeviceId, AccountName, AccountDomain, InitiatingProcessAccountName, FileName, Cmdlet, GroupName, CmdLine, ReportId, TenantId
| sort by TimeGenerated desc
| take 200

DeviceProcessEvents
| where FileName endswith "powershell.exe"  // More precise match for PowerShell executable
| where ProcessCommandLine contains "-Name"  // Look for commands containing the -Name flag
| extend GroupName = extract("-Name\\s+['\"]?([^'\"\\s]+)['\"]?", 1, ProcessCommandLine)  // Enhanced regex to capture the group name after -Name, handling optional quotes and avoiding extra spaces
| where isnotempty(GroupName)  // Ensure only rows with a detected group name are kept
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, GroupName  // Project relevant fields
| order by TimeGenerated desc  // Order by timestamp descending for latest events first

DeviceProcessEvents
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has "-Name"
| extend QueriedGroupQuoted = extract(@'(?)-Name\s+"([^\"]+)"', 1, ProcessCommandLine)
| extend QueriedGroupUnquoted = extract(@'(?)-Name\s+(\S+)', 1, ProcessCommandLine)
| extend QueriedGroup = coalesce(QueriedGroupQuoted, QueriedGroupUnquoted)
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine, QueriedGroup
| summarize QueriedCount = count() by QueriedGroup

DeviceProcessEvents
| where ProcessCommandLine has "powershell" and ProcessCommandLine has "-Name"
| extend GroupQueried = extract("-Name\\s+['\"']?([^ '\"']+)", 1, ProcessCommandLine)
| where isnotempty(GroupQueried)
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, GroupQueried
| order by TimeGenerated desc

DeviceProcessEvents
| where ProcessCommandLine contains "powershell" and ProcessCommandLine contains "-Name"
| extend Group1 = extract(@"-Name\s+'([^']+)'", 1, ProcessCommandLine)
| extend Group2 = extract(@"-Name\s+""([^""]+)""", 1, ProcessCommandLine)
| extend Group3 = extract(@"-Name\s+(\S+)", 1, ProcessCommandLine)
| extend GroupQueried = coalesce(Group1, Group2, Group3)
| where isnotempty(GroupQueried)
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, GroupQueried

DeviceProcessEvents
| where FileName in~ ("powershell.exe","pwsh.exe")
| where ProcessCommandLine matches regex @"-Name\s+\S+"
| extend QueriedGroup = extract(@"-Name\s+(\S+)", 1, ProcessCommandLine)
| where isnotempty(QueriedGroup)
| project TimeGenerated, DeviceName, AccountName = InitiatingProcessAccountName, QueriedGroup, ProcessCommandLine
| sort by TimeGenerated desc

DeviceProcessEvents
| where FileName in ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has "-Name"
| extend QueriedGroup = extract("(?i)-Name\\s+['\\\"]?([^'\\\"\\s]+)", 1, ProcessCommandLine)
| where isnotempty(QueriedGroup)
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, QueriedGroup
| sort by TimeGenerated desc