We recently had a defender incident where a device was involved in User and group membership reconnaissance (SAMR)

Checking the device a powershell script had been run with the command

select * from Win32_UserAccount

If you perform a WMI query such as “SELECT * from Win32_UserAccount” it will actually return all domain accounts regardless if they’ve logged in and have a locally cached profile on the device. 

$LocalAccount = Get-WmiObject -Query "Select Name, LocalAccount FROM WIN32_UserAccount WHERE LocalAccount=true"