Windows LAPS Password Recovery and Administrator Logon Auditing

WLAPS Password Recovery Admin Logon Audit

Query

let Lookback = 30d;
let CorrelationWindow = 4h;
let Recovery =
    AuditLogs
    | where TimeGenerated between (ago(Lookback) .. ago(CorrelationWindow))
    | where OperationName == "Recover device local administrator password"
    | where Result =~ "success"
    | extend
        RecoveryTime = TimeGenerated,
        RequestedBy = tostring(InitiatedBy.user.userPrincipalName),
        Device = tostring(TargetResources[0].displayName)
    | where isnotempty(Device)
    | extend DeviceKey = tolower(tostring(split(Device, ".")[0]))
    | project RecoveryTime, RequestedBy, Device, DeviceKey;
let LocalAdminLogons =
    DeviceLogonEvents
    | where TimeGenerated > ago(Lookback)
    | where ActionType == "LogonSuccess"
    | where IsLocalAdmin == true
    | extend
        DeviceKey = tolower(tostring(split(DeviceName, ".")[0])),
        AccountDomainKey = tolower(AccountDomain),
        IsBuiltInAdmin = AccountSid matches regex @"^S-1-5-21-(\d+-){3}500$"
    | where AccountDomainKey == DeviceKey or IsBuiltInAdmin
    | project
        DeviceKey,
        LogonTime = TimeGenerated,
        DeviceName,
        AccountName,
        AccountSid,
        LogonType,
        RemoteIP,
        RemoteDeviceName;
Recovery
| join kind=inner LocalAdminLogons on DeviceKey
| where LogonTime between (RecoveryTime .. RecoveryTime + CorrelationWindow)
| extend MinutesAfterRecovery = datetime_diff("minute", LogonTime, RecoveryTime)
| project
    RecoveryTime,
    LogonTime,
    MinutesAfterRecovery,
    DeviceName,
    RequestedBy,
    AccountName,
    AccountSid,
    LogonType,
    RemoteIP,
    RemoteDeviceName
| order by RecoveryTime desc, LogonTime asc

About this query

Explanation

This query is designed to help investigate Windows Local Administrator Password Solution (LAPS) activities using Microsoft Defender XDR's advanced hunting capabilities. It focuses on tracking password recoveries and local administrator logons to identify potential security risks. Here's a simplified breakdown:

Objective: The query aims to monitor and analyze the retrieval of Windows LAPS passwords and subsequent local administrator activities. It helps identify who accessed these passwords, on which devices, and whether there were any unusual patterns or excessive retrievals.
Process:
- Identify Password Retrievals: Start by finding successful password recovery events and the users or applications that initiated them.
- Enrich Data: Add more context to these events by linking them with device information.
- Discover Administrator Accounts: Look for local administrator accounts that might be managed by LAPS based on observed logons.
- Correlate Events: Match logon events with prior password recoveries to see if administrator logons occurred shortly after a password was retrieved.
- Detect Anomalies: Find local administrator logons that happened without a recent password recovery, which could indicate potential unauthorized access.
Risk Considerations: Retrieving a LAPS password grants access to privileged credentials. Therefore, unexpected or frequent recoveries, especially by unusual identities, should be investigated. However, these queries alone do not confirm misuse or identify which accounts are managed by LAPS.
Investigation Steps: The query provides a series of steps to follow, starting with identifying devices with recovered passwords, understanding who performed the recoveries, and analyzing logon patterns to detect any suspicious activities.
Data Sources: The query uses data from Microsoft Entra ID audit logs and Microsoft Defender XDR's device logon events and device information tables.
Guidance: It offers guidance on how to interpret the results and what to look for during an investigation, such as validating the role of the requester and checking for any approved password retrieval mechanisms.

Overall, this query serves as a tool for security analysts to monitor and investigate LAPS-related activities, helping to ensure that privileged credentials are not being misused.