On Windows, an elevated SecEdit.exe process was observed exporting the local security policy. Review the process execution records to identify the name of the text file where the policy was saved.

DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where tolower(FileName) == "secedit.exe"
// Must be an export action
| where ProcessCommandLine matches regex @'(?i)(?:^|\s)[/-]export(?:\s|$)'
// Elevated token (either explicit elevation flag or high/system integrity)
| where ProcessTokenElevation =~ "Elevated" or ProcessIntegrityLevel in~ ("High", "System")
// Extract the policy output path after /cfg (handles quotes and no quotes)
| extend SavedPolicyPath = coalesce(
        extract(@'(?i)(?:^|\s)[/-]cfg\s+"([^"]+)"', 1, ProcessCommandLine),
        extract(@'(?i)(?:^|\s)[/-]cfg\s+(\S+)', 1, ProcessCommandLine)
    )
| extend SavedPolicyFileName = tostring(extract(@'([^\\/:*?"<>|]+)$', 1, SavedPolicyPath))
// Optional: also capture /log file if present
| extend LogFilePath = coalesce(
        extract(@'(?i)(?:^|\s)[/-]log\s+"([^"]+)"', 1, ProcessCommandLine),
        extract(@'(?i)(?:^|\s)[/-]log\s+(\S+)', 1, ProcessCommandLine)
    )
| extend LogFileName = tostring(extract(@'([^\\/:*?"<>|]+)$', 1, LogFilePath))
| where isnotempty(SavedPolicyFileName)
| project TimeGenerated, DeviceName, AccountDomain, AccountName, ProcessTokenElevation, ProcessIntegrityLevel, ProcessCommandLine, SavedPolicyPath, SavedPolicyFileName, LogFilePath, LogFileName
| order by TimeGenerated desc

// 1. Filter for SecEdit executions
// 2. Keep only runs that performed an export of the Local Security Policy
// 3. Make sure the process was running elevated (token elevation or high integrity)
// 4. Parse the value that follows the “/cfg” switch – this is the path where the policy is written
// 5. Split the path to obtain the file name only
// 6. Summarise so we get a single (latest) record per device / user / output file
DeviceProcessEvents
| where FileName =~ "secedit.exe"
| where ProcessCommandLine has_any ("/export", " /export", "/EXPORT")
| where ProcessTokenElevation =~ "Elevated" or ProcessIntegrityLevel in ("High", "System")
// try to capture something like  /cfg C:\Temp\policydump.txt  (quotes optional)
| extend ExportedPolicyPath = extract("/cfg\\s+\"?([^\\s\"]+\\.txt)", 1, ProcessCommandLine)
| where isnotempty(ExportedPolicyPath)
| extend ExportedPolicyFileName = tostring(split(ExportedPolicyPath, "\\")[-1])
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, ExportedPolicyPath, ExportedPolicyFileName
| summarize LatestExportTime = max(TimeGenerated)                
          by DeviceName, AccountName, ExportedPolicyPath, ExportedPolicyFileName
| order by LatestExportTime desc

DeviceProcessEvents
| where FileName =~ "SecEdit.exe"
| where ProcessCommandLine contains "/export"
// Optionally, ensure the process was elevated
// | where ProcessTokenElevation has "Elevated"
| extend ExportedFile = extract("(?i)/cfg\\s+(\\S+)", 1, ProcessCommandLine)
| project TimeGenerated, DeviceName, ProcessCommandLine, ExportedFile