KQL Search

Query Details

Anomalies Anomalous Local Account Creation

Query

Anomalies
| where RuleName endswith "Anomalous local account creation" and RuleStatus != "Flighting"
| extend
    Query = ExtendedLinks[0]["DetailBladeInputs"],
    Computer = AnomalyDetails.Observables[0].Value["Computer name"],
    ActorDomain = AnomalyDetails.Observables[0].Value["Source Domain"],
    ActorAccount = AnomalyDetails.Observables[0].Value["Source User name"],
    TargetDomain = AnomalyDetails.Observables[0].Value["Target Domain"],
    TargetAccount = AnomalyDetails.Observables[0].Value["Target User name"]
| project
    TimeGenerated,
    RuleName,
    Description,
    Query,
    UserName,
    Computer,
    ActorDomain,
    ActorAccount,
    TargetDomain,
    TargetAccount,
    Score,
    AnomalyDetails,
    Entities,
    Tactics,
    Techniques,
    ExtendedLinks

Explanation

This query retrieves anomalies where the rule name ends with "Anomalous local account creation" and the rule status is not "Flighting". It then extends the query with additional information such as the computer name, source domain, source user name, target domain, and target user name. Finally, it projects various fields including the time generated, rule name, description, query, user name, computer, actor domain, actor account, target domain, target account, score, anomaly details, entities, tactics, techniques, and extended links.