Detect Enabled Accounts Without Password Change

Identifies accounts enabled with a default password that haven't been changed by the user within 48 hours, significant for Windows Server 2012 or below environments due to blank password options.

Microsoft Sentinel (KQL)