Detect-Not-Active-AD-User-Accounts

Description

// Detect Active Directory service accounts that are not active because their last logon was more than 14 days ago // Replace XXX on line 4 with the naming convention start of your Active Directory service accounts

Query · kql

IdentityLogonEvents 
| project Timestamp, AccountName, DeviceName, LogonType
| where AccountName startswith "XXX" 
| summarize LastLogon = max(Timestamp) by AccountName, LogonType, DeviceName
| where LastLogon < ago(14d)
Raw source Detect-Not-Active-AD-User-Accounts · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 9131b716-334f-416e-a50f-809927d63b42
name: Detect-Not-Active-AD-User-Accounts
description: |
  // Detect Active Directory service accounts that are not active because their last logon was more than 14 days ago
  // Replace XXX on line 4 with the naming convention start of your Active Directory service accounts
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - IdentityLogonEvents
query: |
  IdentityLogonEvents 
  | project Timestamp, AccountName, DeviceName, LogonType
  | where AccountName startswith "XXX" 
  | summarize LastLogon = max(Timestamp) by AccountName, LogonType, DeviceName
  | where LastLogon < ago(14d)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.