KQL Search

# Detect when an account has been changed in order for the password to never expire

## Query Information

#### Description
In Windows a password can be set so that it will never expire. This is normaly not desirable, because a password must be changed every x period. This query detects when a useraccount is set to Account Password Never Expires.

#### Risk
A account that has as password that never exprided on and it has a weak password. That makes it vulnerable for Brute Force attacks. 

## Defender For Endpoint
```
IdentityDirectoryEvents
| where ActionType == "Account Password Never Expires changed"
| extend AdditionalInfo = parse_json(AdditionalFields)
| extend OriginalValue = AdditionalInfo.['FROM Account Password Never Expires']
| extend NewValue = AdditionalInfo.['TO Account Password Never Expires']
| where NewValue == true
| project
     Timestamp,
     AccountName,
     AccountDomain,
     OriginalValue,
     NewValue,
     ReportId,
     DeviceName
```
## Sentinel
```
IdentityDirectoryEvents
| where ActionType == "Account Password Never Expires changed"
| extend AdditionalInfo = parse_json(AdditionalFields)
| extend OriginalValue = AdditionalInfo.['FROM Account Password Never Expires']
| extend NewValue = AdditionalInfo.['TO Account Password Never Expires']
| where NewValue == true
| project
     TimeGenerated,
     AccountName,
     AccountDomain,
     OriginalValue,
     NewValue,
     ReportId,
     DeviceName
```