Question Analysis

DeviceProcessEvents | where ProcessCommandLine contains '-Name' | extend GroupName = tostring(split(ProcessCommandLine, '-Name ')[1]) | project GroupName, DeviceName, TimeGenerated

DeviceProcessEvents | where ProcessCommandLine has_any ('powershell', 'pwsh') and (ProcessCommandLine has 'Get-ADGroupMember' or ProcessCommandLine has 'Get-LocalGroupMember') and ProcessCommandLine has '-Name' | extend QueriedGroup = extract("-Name ['\"]*([^'\" ]+)['\"]*", 1, ProcessCommandLine) | where isnotempty(QueriedGroup) | project TimeGenerated, DeviceName, AccountName, InitiatingProcessAccountName, ProcessCommandLine, QueriedGroup

DeviceProcessEvents | where ProcessCommandLine has "-Name" and (ProcessCommandLine has "Get-LocalGroupMember" or ProcessCommandLine has "Get-ADGroupMember" or ProcessCommandLine has "Get-GroupMember" or ProcessCommandLine has "Get-Group") | extend GroupName = extract("-Name\\s+['\"]?([\\w\\d\\\\._-]+)['\"]?", 1, ProcessCommandLine) | where isnotempty(GroupName) | project TimeGenerated, DeviceName, AccountName, ProcessCreationTime, ProcessCommandLine, GroupName | order by TimeGenerated desc

DeviceProcessEvents | where ProcessCommandLine has "-Name" | extend GroupName = extract("-Name\\s+(['\"]?)(.*?)(['\"]?\\s|$)", 2, ProcessCommandLine) | where isnotempty(GroupName) | project TimeGenerated, AccountName, DeviceName, ProcessCommandLine, GroupName

DeviceProcessEvents | where FileName in~ ("powershell.exe", "pwsh.exe", "powershell_ise.exe") | where ProcessCommandLine has_any ("Get-LocalGroupMember","Get-ADGroupMember","Get-DistributionGroupMember","Get-AzureADGroupMember","Get-MgGroupMember","Get-LocalGroup") | where ProcessCommandLine has "-Name" | extend GroupName = coalesce( extract(@'(?i)-name\s*(?::|=)?\s*"([^"]+)"', 1, ProcessCommandLine), extract(@'(?i)-name\s*(?::|=)?\s*''([^'']+)''', 1, ProcessCommandLine), extract(@'(?i)-name\s*(?::|=)?\s*([^\s\|\;]+)', 1, ProcessCommandLine) ) | where isnotempty(GroupName) | extend Cmdlet = case( ProcessCommandLine matches regex @'(?i)\bGet-LocalGroupMember\b', 'Get-LocalGroupMember', ProcessCommandLine matches regex @'(?i)\bGet-ADGroupMember\b', 'Get-ADGroupMember', ProcessCommandLine matches regex @'(?i)\bGet-AzureADGroupMember\b', 'Get-AzureADGroupMember', ProcessCommandLine matches regex @'(?i)\bGet-DistributionGroupMember\b', 'Get-DistributionGroupMember', ProcessCommandLine matches regex @'(?i)\bGet-MgGroupMember\b', 'Get-MgGroupMember', ProcessCommandLine matches regex @'(?i)\bGet-LocalGroup\b', 'Get-LocalGroup', 'Unknown') | project TimeGenerated, DeviceName, AccountDomain, AccountName, FileName, Cmdlet, GroupName, ProcessCommandLine, InitiatingProcessParentFileName, InitiatingProcessAccountDomain, InitiatingProcessAccountName | order by TimeGenerated desc

let nameRegex = @"(?i)(?:-Name|-Identity)\s+(?:'([^']+)'|""([^""]+)""|([^\s)]+))"; union DeviceProcessEvents, DeviceEvents | extend CmdLine = coalesce(ProcessCommandLine, InitiatingProcessCommandLine) | where isnotempty(CmdLine) // focus on likely PowerShell usage or explicit cmdlet mentions | where CmdLine has_any ("Get-ADGroupMember","Get-LocalGroupMember","Get-ADGroup","Get-ADPrincipalGroupMembership","Get-LocalGroup","Get-GroupMember") or CmdLine has_any ("powershell.exe","pwsh.exe","PowerShell_ISE.exe") // capture the cmdlet if present | extend Cmdlet = extract(@"(?i)\b(Get-ADGroupMember|Get-LocalGroupMember|Get-ADGroup|Get-ADPrincipalGroupMembership|Get-LocalGroup|Get-GroupMember)\b", 1, CmdLine) // extract group name after -Name or -Identity (handles 'quoted', ""double-quoted"", and unquoted tokens) | extend g1 = extract(nameRegex, 1, CmdLine), g2 = extract(nameRegex, 2, CmdLine), g3 = extract(nameRegex, 3, CmdLine) | extend GroupName = coalesce(g1, g2, g3) | where isnotempty(GroupName) | project TimeGenerated, DeviceName, DeviceId, AccountName, AccountDomain, InitiatingProcessAccountName, FileName, Cmdlet, GroupName, CmdLine, ReportId, TenantId | sort by TimeGenerated desc | take 200

DeviceProcessEvents | where FileName endswith "powershell.exe" // More precise match for PowerShell executable | where ProcessCommandLine contains "-Name" // Look for commands containing the -Name flag | extend GroupName = extract("-Name\\s+['\"]?([^'\"\\s]+)['\"]?", 1, ProcessCommandLine) // Enhanced regex to capture the group name after -Name, handling optional quotes and avoiding extra spaces | where isnotempty(GroupName) // Ensure only rows with a detected group name are kept | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, GroupName // Project relevant fields | order by TimeGenerated desc // Order by timestamp descending for latest events first

DeviceProcessEvents | where FileName =~ "powershell.exe" | where ProcessCommandLine has "-Name" | extend QueriedGroupQuoted = extract(@'(?)-Name\s+"([^\"]+)"', 1, ProcessCommandLine) | extend QueriedGroupUnquoted = extract(@'(?)-Name\s+(\S+)', 1, ProcessCommandLine) | extend QueriedGroup = coalesce(QueriedGroupQuoted, QueriedGroupUnquoted) | project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine, QueriedGroup | summarize QueriedCount = count() by QueriedGroup

DeviceProcessEvents | where ProcessCommandLine has "powershell" and ProcessCommandLine has "-Name" | extend GroupQueried = extract("-Name\\s+['\"']?([^ '\"']+)", 1, ProcessCommandLine) | where isnotempty(GroupQueried) | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, GroupQueried | order by TimeGenerated desc

DeviceProcessEvents | where ProcessCommandLine contains "powershell" and ProcessCommandLine contains "-Name" | extend Group1 = extract(@"-Name\s+'([^']+)'", 1, ProcessCommandLine) | extend Group2 = extract(@"-Name\s+""([^""]+)""", 1, ProcessCommandLine) | extend Group3 = extract(@"-Name\s+(\S+)", 1, ProcessCommandLine) | extend GroupQueried = coalesce(Group1, Group2, Group3) | where isnotempty(GroupQueried) | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, GroupQueried

DeviceProcessEvents | where FileName in~ ("powershell.exe","pwsh.exe") | where ProcessCommandLine matches regex @"-Name\s+\S+" | extend QueriedGroup = extract(@"-Name\s+(\S+)", 1, ProcessCommandLine) | where isnotempty(QueriedGroup) | project TimeGenerated, DeviceName, AccountName = InitiatingProcessAccountName, QueriedGroup, ProcessCommandLine | sort by TimeGenerated desc

DeviceProcessEvents | where FileName in ("powershell.exe", "pwsh.exe") | where ProcessCommandLine has "-Name" | extend QueriedGroup = extract("(?i)-Name\\s+['\\\"]?([^'\\\"\\s]+)", 1, ProcessCommandLine) | where isnotempty(QueriedGroup) | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, QueriedGroup | sort by TimeGenerated desc