KQL Search

This query is designed to extract and list Active Directory Service Accounts using Microsoft Defender for Identity. Here's a simple breakdown of what it does:

1. Purpose: The query aims to identify and list service accounts from Active Directory, which are managed by Microsoft Defender for Identity. These accounts include:

   • gMSA (Group Managed Service Accounts): Used for services requiring mutual authentication across multiple servers.
   • sMSA (Managed Service Accounts): Used for individual services on a single server.
   • User Accounts: Regular user accounts configured with "Password never expires" and a Service Principal Name (SPN) are also considered service accounts.

2. Query Breakdown:

   • The first part of the query filters the IdentityInfo table to find entries from the last 30 days (Timestamp > ago(30d)) that are classified as "ServiceAccount" and originate from "ActiveDirectory". It then summarizes the most recent entry for each service account using arg_max(Timestamp,*) by OnPremSid (On-Premises Security Identifier).

   • The second part of the query further processes the IdentityInfo table to summarize the most recent entry for each account by AccountName. It extracts the Organizational Unit (OU) path from the DistinguishedName field and filters for those containing "OU=ServiceAccounts". Finally, it lists distinct OU paths where service accounts are located.

3. Outcome: The result is a list of Active Directory service accounts and their organizational units, helping administrators identify and manage these accounts effectively.