Detect Enabled Accounts Without Password Change
Identifies accounts enabled with a default password that haven't been changed by the user within 48 hours, significant for Windows Server 2012 or below environments due to blank password options.
Microsoft Sentinel (KQL)

