← Library
kqlMITfrom Azure/Azure-Sentinel

AD account with Don't Expire Password

'Identifies whenever a user account has the setting "Password Never Expires" in the user account properties selected. This is indicated in Security event 4738 in the EventData item labeled UserAccountControl with an included value of %%2089. %%2089 resolves to "Don't Expire Password - Enabled".'

Quality
92
FP risk
Forks
0
Views
1
ATT&CK techniques
Rule source🔒 locked
🔒

Sign in to view the rule source

Free accounts can view the source for the top-ranked rules. Create one in seconds — no credit card required.

Sign in →