KQL_win_susp_net_recon_activity.txt

SecurityEvent | where (EventID == "4661" and AccessMask == "0x2d" and ((ObjectType == "SAM_USER" and ObjectName matches regex "S-1-5-21-.*-500") or (ObjectType == "SAM_GROUP" and ObjectName matches regex "S-1-5-21-.*-512")))