kqlHunting

UEBA - Find Onpremise users with Password Not Required

Requires UEBA to be setup

Detection Query

IdentityInfo //Requires UEBA to be setup
| where tostring(UserAccountControl) contains "PasswordNotRequired"
| summarize arg_max(TimeGenerated,*) by AccountName, tostring(UserAccountControl)

Data Sources

IdentityInfo

Tags

entra

Raw Content

IdentityInfo //Requires UEBA to be setup
| where tostring(UserAccountControl) contains "PasswordNotRequired"
| summarize arg_max(TimeGenerated,*) by AccountName, tostring(UserAccountControl)