localAdminAccountLogon
This query looks for local admin account used to logon into the computer. This can help to detect malicious insiders that were able to add a local account to the local admin group offline.
Microsoft Sentinel (KQL)
This query looks for local admin account used to logon into the computer. This can help to detect malicious insiders that were able to add a local account to the local admin group offline.
Already have an account?