Skip to content

Instantly share code, notes, and snippets.

@Castaldio86
Created November 2, 2020 22:07
  • Star 2 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
Star You must be signed in to star a gist
Save Castaldio86/ce48fc95749ab70369775a72a9f5fa5e to your computer and use it in GitHub Desktop.
let DC = DeviceNetworkEvents
| where LocalPort == "88"
| distinct DeviceId
| extend Type = "DomainController"
;
let SVR = DeviceInfo
| where OSPlatform in ("WindowsServer2008R2","WindowsServer2019","WindowsServer2016","WindowsServer2012R2") and RegistryDeviceTag !contains "Domain Controllers"
| distinct DeviceId
| extend Type = "Server"
;
let WKS = DeviceInfo
| where OSPlatform in ("Windows10","Windows7","Windows8Blue")
| distinct DeviceId
| extend Type = "Workstation"
;
let OSTypes =
union DC, SVR, WKS
;
DeviceLogonEvents
| where Timestamp > ago(1d)
| extend AF = parse_json(AdditionalFields)
| where IsLocalAdmin == 1 and AF.IsLocalLogon == "true"
| project Timestamp, DeviceName, DeviceId, AccountDomain, AccountName
| summarize LastObserved = max(Timestamp) by DeviceName, DeviceId, AccountDomain, AccountName
| sort by AccountName asc
| join kind=leftouter OSTypes on DeviceId
| project-away DeviceId1
@Castaldio86
Copy link
Author

For more information about this query read the blog post

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment