Within Windows process event logs, identify instances where the built-in net.exe utility is used to change a user account password. What was the new password argument passed in?

DeviceProcessEvents
| where FileName == 'net.exe'
| where ProcessCommandLine contains 'user'
| extend NewPasswordArgument = extract("(?i)user [^ ]+ ([^ ]+)", 1, ProcessCommandLine)
| project DeviceName, AccountName, ProcessCommandLine, NewPasswordArgument

DeviceProcessEvents
| where InitiatingProcessCommandLine != "" and ProcessCommandLine has "net user" and ProcessCommandLine contains "/add"
| extend NewPassword = extract(@"net user [^ ]+ ([^ ]+)", 1, ProcessCommandLine)
| where isnotnull(NewPassword)
| summarize LatestTimeGenerated = arg_max(TimeGenerated, *) by AccountName, AccountDomain, AccountSid, DeviceName, ProcessCommandLine, InitiatingProcessCommandLine, NewPassword, FolderPath
| project TimeGenerated = LatestTimeGenerated, AccountName, AccountDomain, AccountSid, DeviceName, ProcessCommandLine, InitiatingProcessCommandLine, NewPassword, FolderPath
| order by TimeGenerated desc

DeviceProcessEvents
| where FileName =~ 'net.exe'
| where ProcessCommandLine contains 'user'
| where ProcessCommandLine matches regex @'user\s+[^\s]+\s+[^\s]+'
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, FileName, FolderPath

DeviceProcessEvents
| where FileName =~ "net.exe"
| where ProcessCommandLine has " user "
| project TimeGenerated,
          DeviceName,
          AccountName,
          UserAccount = extract(@"(?i)net(?:\.exe)?\\s+user\\s+(\\S+)\\s+(\\S+)", 1, ProcessCommandLine),
          NewPassword = extract(@"(?i)net(?:\.exe)?\\s+user\\s+(\\S+)\\s+(\\S+)", 2, ProcessCommandLine),
          ProcessCommandLine
| order by TimeGenerated desc

DeviceProcessEvents
| where tolower(InitiatingProcessFileName) == 'net.exe'
| where InitiatingProcessCommandLine has 'user'
| extend NewPassword = extract(@"(?i)net\.exe\s+user\s+\S+\s+(\S+)", 1, InitiatingProcessCommandLine)
| where isnotempty(NewPassword)
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, NewPassword

DeviceProcessEvents
| where FileName =~ "net.exe"
| where InitiatingProcessCommandLine has "user"
| extend NewPassword = extract(@"net\.exe\s+user\s+\S+\s+(?<NewPassword>\S+)", 1, InitiatingProcessCommandLine)
| where isnotempty(NewPassword)
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, NewPassword

DeviceProcessEvents
// Filter for the built-in net.exe utility
| where tolower(FileName) == "net.exe"
// Look for the "net user <account> <newpassword>" pattern
| where ProcessCommandLine matches regex @"\bnet\s+user\s+\S+\s+\S+"
// Extract the account name and the new password argument
| extend AccountName = extract(@"\bnet\s+user\s+(\S+)\s+\S+", 1, ProcessCommandLine),
         NewPassword = extract(@"\bnet\s+user\s+\S+\s+(\S+)", 1, ProcessCommandLine)
// Select relevant columns
| project TimeGenerated, DeviceName, InitiatingProcessAccountDomain, InitiatingProcessAccountName, AccountName, NewPassword, ProcessCommandLine

DeviceProcessEvents
| where FileName =~ "net.exe"
| where ProcessCommandLine has " user "
| extend TargetUser = extract(@"net\.exe\s+user\s+(\S+)", 1, ProcessCommandLine),
         NewPassword = extract(@"net\.exe\s+user\s+\S+\s+(\S+)", 1, ProcessCommandLine)
| where isnotempty(NewPassword) and NewPassword != "*"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, TargetUser, NewPassword, ProcessCommandLine