localAdminAccountLogon

Description

This query looks for local admin account used to logon into the computer. This can help to detect malicious insiders that were able to add a local account to the local admin group offline.

Query · kql

DeviceLogonEvents
| where IsLocalAdmin == 1
 and AccountDomain == DeviceName
Raw source localAdminAccountLogon · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 2211b57b-7d13-435d-89a9-40f333249605
name: localAdminAccountLogon
description: |
  This query looks for local admin account used to logon into the computer.
  This can help to detect malicious insiders that were able to add a local account to the local admin group offline.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceLogonEvents
query: |
  DeviceLogonEvents
  | where IsLocalAdmin == 1
   and AccountDomain == DeviceName

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.