List User Account Added To Administrators Group
Description
Adversaries may create local accounts to maintain access to victim systems. This KQL query lists all the local admins that have been added in the selected time frame per device.
Risk
Local Admin accounts have high privileges on and can should be limited.
Query
Microsoft Defender For Endpoint
Kusto
DeviceEvents
| where ActionType == "UserAccountAddedToLocalGroup"
| extend Details = parse_json(AdditionalFields)
| extend
GroupName = tostring(Details.GroupName),
GroupDomainName = tostring(Details.GroupDomainName),
GroupSid = tostring(Details.GroupSid)
// Filter Local Administrators
| where GroupSid == "S-1-5-32-544"
| summarize LocalAdmins = make_set(AccountSid) by DeviceName
| extend TotalLocalAdmins = array_length(LocalAdmins)
| sort by TotalLocalAdminsMicrosoft Sentinel
Kusto
DeviceEvents
| where ActionType == "UserAccountAddedToLocalGroup"
| extend Details = parse_json(AdditionalFields)
| extend
GroupName = tostring(Details.GroupName),
GroupDomainName = tostring(Details.GroupDomainName),
GroupSid = tostring(Details.GroupSid)
// Filter Local Administrators
| where GroupSid == "S-1-5-32-544"
| summarize LocalAdmins = make_set(AccountSid) by DeviceName
| extend TotalLocalAdmins = array_length(LocalAdmins)
| sort by TotalLocalAdmins