Mass account password change

id: 4d8285d1-deac-4eb6-8cdf-267ed37ef39e
name: Mass account password change
description: |
  Prior to deploying Macaw ransomware in an organization, adversaries will change the password for hundreds or thousands of accounts in order to lock users out of the network and impeded recovery efforts.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Ransomware
query: |
  DeviceProcessEvents 
  | where ProcessCommandLine has_all('user', '/Domain', '/Active:Yes', '/PasswordChg:No') 
  | summarize commands=count() by DeviceId, bin(Timestamp, 1d)  
  | where commands > 200