Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Exposure Management + Defender for Office 365

Steven Lim@KQLWizard

•updated Jul 1, 2025•6•0•70

KQL Query from file: Exposure Management + Defender for Office 365

Microsoft Sentinel (KQL)

Tags

T1071.001 - Web Protocols T1566.002 - Spearphishing Link T1078 - Valid Accounts T1087.002 - Domain Account TA0011 - Command and Control TA0001 - Initial Access TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0007 - Discovery T1114 - Email Collection T1114.002 - Remote Email Collection T1114.001 - Local Email Collection T1204 - User Execution T1204.001 - Malicious Link T1204.004 - Malicious Copy and Paste T1566 - Phishing T1598 - Phishing for Information TA0006 - Credential Access T1212 - Exploitation for Credential Access TA0009 - Collection TA0002 - Execution TA0043 - Reconnaissance Email Phishing Detected Email Malware Detected Network Connection Authentication Attempt Credential Access Logon Event User Account Modified Admin Activity Office 365 Azure M365 Unified Audit Log Azure Ad Risk Detection Microsoft Exchange Serverkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?