KQL-MTP-Hunt-Admins

let DC = DeviceNetworkEvents
| where LocalPort == "88"
| distinct DeviceId
| extend Type = "DomainController"
;
let SVR = DeviceInfo
| where OSPlatform in ("WindowsServer2008R2","WindowsServer2019","WindowsServer2016","WindowsServer2012R2") and RegistryDeviceTag !contains "Domain Controllers"
| distinct DeviceId
| extend Type = "Server"
;
let WKS = DeviceInfo
| where OSPlatform in ("Windows10","Windows7","Windows8Blue")
| distinct DeviceId
| extend Type = "Workstation"
;
let OSTypes =
union DC, SVR, WKS
;
DeviceLogonEvents
| where Timestamp > ago(1d)
| extend AF = parse_json(AdditionalFields)
| where IsLocalAdmin == 1 and AF.IsLocalLogon == "true" 
| project Timestamp, DeviceName, DeviceId, AccountDomain, AccountName
| summarize LastObserved = max(Timestamp) by DeviceName, DeviceId, AccountDomain, AccountName
| sort by AccountName asc
| join kind=leftouter OSTypes on DeviceId
| project-away DeviceId1 

For more information about this query read the blog post