Certified Pre-Owned - backup of CA private key - rule 2

Original query, unchanged.

SecurityEvent
// Fill in the machine name of your CA.
| where EventID == 5059 and Computer contains "<YOUR CA MACHINE NAME>"
| where EventData contains "%%2499" and EventData contains "%%2464"
| extend EventData=parse_xml(EventData)
| mv-apply d=EventData.EventData.Data on
(
    where d["@Name"]=="KeyName"
    | project KeyName=tostring(d["#text"])
)
| mv-apply d=EventData.EventData.Data on
(
    where d["@Name"]=="SubjectUserName"
    | project SubjectUserName=tostring(d["#text"])
)
| parse Account with "<YOUR DOMAIN NAME>\\" CleanAccount "$"
| where not(Computer startswith CleanAccount)