KQL on Anything About IT

Exploring IdentityAccountInfo - Building a KQL Query to Assess Identity Password Security Posture

Sat, 06 Dec 2025 12:27:02 +0000

Recently Microsoft Defender XDR introduced a new table called IdentityAccountInfo, and this one immediately caught my attention. It brings several interesting attributes into Advanced Hunting, including LastPasswordChangeTime and even the sensitivity classification of an identity.

Naturally, my first thought was: this is perfect material for some hunting logic, so let’s build a KQL query out of it.

Why am I excited about this? Because it finally allows us to query identity hygiene data straight from Defender. No external inventory dumps, no AD scripting, just KQL.

Shedding Light on Dormant Sensitive Accounts

Tue, 08 Jul 2025 15:34:54 +0000

Dormant sensitive accounts are a high-risk identity exposure. In Microsoft Defender XDR, the recommendation Remove dormant accounts from sensitive groups helps surface these accounts, including whether they are inactive, disabled, or have expired credentials.

You can export the detected entities, but the export often contains limited context. In many cases, you only get entity names or SID values, which makes remediation harder when you need ownership and organizational details.

A practical approach is to use the SID values to enrich the result set with identity attributes from IdentityInfo. You can quickly build a SID variable list using KustoVars, then query Defender XDR for additional context.

Users can create AzureAD tenants

Tue, 22 Nov 2022 22:13:09 +0000

Hello there,

In this blog post we look at a setting within the Azure AD portal: “Users can create Azure AD tenants”. Unfortunately, this setting is enabled by default. Most organizations will probably want to turn this off. You can find it in the Azure AD portal under Settings > Users > User settings > Tenant creation.

Yes allows default users to create Azure AD tenants. No allows only users with the Global Administrator or Tenant Creator roles to create Azure AD tenants. Anyone who creates a tenant becomes the Global Administrator for that tenant.

Generating Advanced hunting queries with PowerShell

Fri, 10 Jul 2020 23:21:46 +0000

I was recently writing some advanced hunting queries for Microsoft Defender ATP to search for the execution of specific PowerShell commands. If you are just looking for one specific command, you can run query as sown below

// Find all machines running a given Powersehll cmdlet.
let powershellCommandName = "Invoke-RickAscii"; 
DeviceEvents 
| where ActionType == "PowerShellCommand" 
| where AdditionalFields contains powershellCommandName

But if you are looking for several functions, then there is going to be a lot of manual editing, and so the idea was born to use PowerShell to help me generate an advanced hunting query. The below function can do the following: