Non-local logons with -500 account

Description

Non-local logons with the built-in administrator (-500) account.

Query · kql

DeviceLogonEvents
| where AccountSid endswith '-500' and parse_json(AdditionalFields).IsLocalLogon != true
| join kind=leftanti IdentityLogonEvents on AccountSid // Remove the domain's built-in admin acccount
Raw source Non-local logons with -500 account · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 435fead8-a25e-44be-9508-1985f8d724e6
name: Non-local logons with -500 account
description: |
  Non-local logons with the built-in administrator (-500) account.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceLogonEvents
  - IdentityLogonEvents
query: |
  DeviceLogonEvents
  | where AccountSid endswith '-500' and parse_json(AdditionalFields).IsLocalLogon != true
  | join kind=leftanti IdentityLogonEvents on AccountSid // Remove the domain's built-in admin acccount

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.