Question Analysis

DeviceProcessEvents | where FileName == "net.exe" | where ProcessCommandLine has "accounts" | project Timestamp, DeviceName, InitiatingProcessCommandLine, ProcessCommandLine, AccountName, AccountDomain

DeviceProcessEvents | where ProcessCommandLine contains 'net accounts' | project DeviceName, ProcessId, ProcessCommandLine, ProcessCreationTime

DeviceProcessEvents | where ProcessCommandLine has 'net accounts' or ProcessCommandLine has 'net user' | project DeviceName, DeviceId, ProcessCommandLine, TimeGenerated

DeviceProcessEvents | where (FileName =~ "net.exe" and ProcessCommandLine has "accounts") or (FileName =~ "secedit.exe" and ProcessCommandLine has "/export") | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine

DeviceProcessEvents | where ProcessCommandLine has_any ("net accounts", "secpol.msc", "net user", "gpresult", "net user /domain") | project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where ProcessCommandLine contains 'net accounts' | project TimeGenerated, DeviceName, ProcessCommandLine

DeviceProcessEvents | where InitiatingProcessCommandLine has_any ("net accounts", "secedit") | project TimeGenerated, DeviceName, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessAccountUpn

DeviceProcessEvents | where ActionType == "ProcessCreated" | extend FileLower = tolower(FileName), CmdLower = tolower(ProcessCommandLine) | where (FileLower in ("net.exe", "net1.exe") and CmdLower matches regex @"\bnet(1|\.exe)?\s+accounts(\s|$)") or (FileLower == "secedit.exe" and CmdLower has_any (" /export", " -export")) | extend PolicyScope = iif(CmdLower has "/domain", "Domain", "Local") | extend Method = case( FileLower in ("net.exe", "net1.exe"), "Listed password policy via 'net accounts'", FileLower == "secedit.exe", "Exported local security policy via 'secedit /export'", "Other") | project TimeGenerated, DeviceName, AccountDomain, AccountName, FileName, ProcessCommandLine, PolicyScope, Method, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountDomain, InitiatingProcessAccountName | order by TimeGenerated desc

(DeviceProcessEvents | where isnotempty(ProcessCommandLine) | where ProcessCommandLine has_cs "net accounts" or ProcessCommandLine has_cs "secedit" or ProcessCommandLine has_cs "net user" or ProcessCommandLine has_cs "gpresult" or ProcessCommandLine has_cs "Get-LocalUser" or ProcessCommandLine has_cs "Get-LocalGroup" or ProcessCommandLine has_cs "net accounts /domain" or ProcessCommandLine has_cs "net accounts /minpwlen" | extend CommandLine = ProcessCommandLine, Source = "DeviceProcessEvents" ) | union ( DeviceEvents | where isnotempty(ProcessCommandLine) or isnotempty(InitiatingProcessCommandLine) | extend CommandLine = coalesce(ProcessCommandLine, InitiatingProcessCommandLine), Source = "DeviceEvents" | where CommandLine has_cs "net accounts" or CommandLine has_cs "secedit" or CommandLine has_cs "net user" or CommandLine has_cs "gpresult" or CommandLine has_cs "Get-LocalUser" or CommandLine has_cs "Get-LocalGroup" or CommandLine has_cs "net accounts /domain" or CommandLine has_cs "net accounts /minpwlen" ) | summarize Count = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceId, DeviceName, AccountName = coalesce(InitiatingProcessAccountName, AccountName, "-"), CommandLine, Source | order by LastSeen desc | project LastSeen, FirstSeen, Count, DeviceName, DeviceId, AccountName, CommandLine, Source

// Search for commands that list local or domain password policy settings let keywords = dynamic(["net accounts","secedit /export","secedit /configure","secedit /export /cfg","gpresult /r","gpresult /h","auditpol /get","net user","get-localuser","get-localgroup","get-addefaultdomainpasswordpolicy","net accounts /domain"]); // Process events with explicit ProcessCommandLine let procEvents = DeviceProcessEvents | where isnotempty(ProcessCommandLine) | extend cmd = tolower(ProcessCommandLine) | where cmd contains "net accounts" or cmd contains "secedit /export" or cmd contains "secedit /configure" or cmd contains "secedit /export /cfg" or cmd contains "gpresult /r" or cmd contains "gpresult /h" or cmd contains "auditpol /get" or cmd contains "net user" or cmd contains "get-localuser" or cmd contains "get-localgroup" or cmd contains "get-addefaultdomainpasswordpolicy" or cmd contains "net accounts /domain" | project TimeGenerated, DeviceName, DeviceId, AccountName, AccountDomain, InitiatingProcessAccountName, InitiatingProcessAccountDomain, FileName, ProcessId, InitiatingProcessId, ProcessCommandLine = ProcessCommandLine, InitiatingProcessCommandLine, ProcessCreationTime, InitiatingProcessCreationTime, ReportId; // Generic DeviceEvents which may store commandline in different fields let devEvents = DeviceEvents | extend cmd = coalesce(tolower(InitiatingProcessCommandLine), tolower(ProcessCommandLine), tolower(tostring(AdditionalFields.CommandLine))) | where isnotempty(cmd) | where cmd contains "net accounts" or cmd contains "secedit /export" or cmd contains "secedit /configure" or cmd contains "secedit /export /cfg" or cmd contains "gpresult /r" or cmd contains "gpresult /h" or cmd contains "auditpol /get" or cmd contains "net user" or cmd contains "get-localuser" or cmd contains "get-localgroup" or cmd contains "get-addefaultdomainpasswordpolicy" or cmd contains "net accounts /domain" | project TimeGenerated, DeviceName, DeviceId, AccountName, AccountDomain, InitiatingProcessAccountName, InitiatingProcessAccountDomain, FileName, ProcessId, InitiatingProcessId, ProcessCommandLine = cmd, InitiatingProcessCommandLine, ProcessCreationTime, InitiatingProcessCreationTime, ReportId; // Combine and summarize procEvents | union devEvents | summarize Count = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceName, DeviceId, AccountName, InitiatingProcessAccountName, FileName, ProcessCommandLine | order by LastSeen desc | limit 100

let pattern = @"(?i)\b(net accounts|net\s+user\b|secedit\s*/?(?:export|configure)|gpresult\b|get-localuser\b|get-localgroup\b)\b"; union isfuzzy=true ( DeviceProcessEvents | extend Cmd = tostring(coalesce(ProcessCommandLine, InitiatingProcessCommandLine, FileName)) | where isnotempty(Cmd) and Cmd matches regex pattern | extend MatchedCommand = extract(@"(?i)\b(net accounts|net\s+user|secedit\s*/?(?:export|configure)|gpresult|get-localuser|get-localgroup)\b", 1, Cmd) | project TimeGenerated, DeviceName, DeviceId, AccountName, AccountDomain = InitiatingProcessAccountDomain, InitiatingProcessFileName, ProcessCommandLine, InitiatingProcessCommandLine, MatchedCommand, ProcessId, InitiatingProcessId, ReportId, FileName ), ( DeviceEvents | extend Cmd = tostring(coalesce(ProcessCommandLine, InitiatingProcessCommandLine, FileName)) | where isnotempty(Cmd) and Cmd matches regex pattern | extend MatchedCommand = extract(@"(?i)\b(net accounts|net\s+user|secedit\s*/?(?:export|configure)|gpresult|get-localuser|get-localgroup)\b", 1, Cmd) | project TimeGenerated, DeviceName, DeviceId, AccountName, AccountDomain = InitiatingProcessAccountDomain, InitiatingProcessFileName, ProcessCommandLine, InitiatingProcessCommandLine, MatchedCommand, ProcessId = InitiatingProcessId, InitiatingProcessId = InitiatingProcessParentId, ReportId, FileName ) | sort by TimeGenerated desc | take 500

DeviceProcessEvents | where tolower(InitiatingProcessCommandLine) contains "net accounts" or tolower(ProcessCommandLine) contains "net accounts" or (tolower(InitiatingProcessFileName) == "net.exe" and tolower(InitiatingProcessCommandLine) contains "accounts") | project TimeGenerated, DeviceName, DeviceId, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCommandLine, InitiatingProcessId, InitiatingProcessAccountDomain, InitiatingProcessAccountName | sort by TimeGenerated desc

DeviceProcessEvents | where InitiatingProcessFileName endswith 'net.exe' or InitiatingProcessCommandLine contains 'net accounts' or ProcessCommandLine contains 'net accounts' | extend CommandLine = coalesce(InitiatingProcessCommandLine, ProcessCommandLine) | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCreationTime, CommandLine | order by TimeGenerated desc

DeviceProcessEvents | where ProcessCommandLine contains 'net accounts' | project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine | order by Timestamp desc

DeviceProcessEvents | where ActionType == 'ProcessCreated' and (ProcessCommandLine contains 'net accounts') | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine | summarize arg_max(TimeGenerated, *) by DeviceName, ProcessCommandLine | order by TimeGenerated desc | limit 100

DeviceProcessEvents | where FileName =~ "net.exe" | where ProcessCommandLine has "accounts" | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where ProcessCommandLine has '\net accounts' or (FileName =~ 'net.exe' and ProcessCommandLine has 'accounts') | project TimeGenerated, DeviceName, AccountDomain, AccountName, ProcessCommandLine, FolderPath, FileName | order by TimeGenerated desc

// Password-policy enumeration using native Windows commands DeviceProcessEvents | where ActionType == "ProcessCreated" // only new processes // Look for commands that dump local password policy (case-insensitive) | where (FileName in~ ("net.exe", "net1.exe") and ProcessCommandLine has_cs "accounts") or (FileName =~ "secedit.exe" and ProcessCommandLine has "/export" and ProcessCommandLine has "/cfg") // Surface the most relevant context | project TimeGenerated, DeviceName, DeviceId, ExecutingUser = tostring(coalesce(AccountName, InitiatingProcessAccountName)), UserDomain = tostring(coalesce(AccountDomain, InitiatingProcessAccountDomain)), CommandLine = ProcessCommandLine, ParentProcess = strcat(InitiatingProcessParentFileName, " (PID ", tostring(InitiatingProcessParentId), ")"), SHA256 | order by TimeGenerated desc

DeviceProcessEvents | where InitiatingProcessCommandLine has_cs "net accounts" | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, FileName, FolderPath | order by TimeGenerated desc

DeviceProcessEvents | where InitiatingProcessFileName =~ "net.exe" | where InitiatingProcessCommandLine has "accounts" | project TimeGenerated, DeviceName, InitiatingProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where ProcessCommandLine has "net accounts" | project TimeGenerated, DeviceName, InitiatingProcessAccountDomain, InitiatingProcessAccountName, ProcessCommandLine | sort by TimeGenerated desc