Skip to content

Instantly share code, notes, and snippets.

@Castaldio86
Created November 2, 2020 22:07
Embed
What would you like to do?
let DC = DeviceNetworkEvents
| where LocalPort == "88"
| distinct DeviceId
| extend Type = "DomainController"
;
let SVR = DeviceInfo
| where OSPlatform in ("WindowsServer2008R2","WindowsServer2019","WindowsServer2016","WindowsServer2012R2") and RegistryDeviceTag !contains "Domain Controllers"
| distinct DeviceId
| extend Type = "Server"
;
let WKS = DeviceInfo
| where OSPlatform in ("Windows10","Windows7","Windows8Blue")
| distinct DeviceId
| extend Type = "Workstation"
;
let OSTypes =
union DC, SVR, WKS
;
DeviceLogonEvents
| where Timestamp > ago(1d)
| extend AF = parse_json(AdditionalFields)
| where IsLocalAdmin == 1 and AF.IsLocalLogon == "true"
| project Timestamp, DeviceName, DeviceId, AccountDomain, AccountName
| summarize LastObserved = max(Timestamp) by DeviceName, DeviceId, AccountDomain, AccountName
| sort by AccountName asc
| join kind=leftouter OSTypes on DeviceId
| project-away DeviceId1
@Castaldio86
Copy link
Author

For more information about this query read the blog post

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment