Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Detect vulnerable device with Global Admin browser cookie credential

Steven Lim@KQLWizard

•updated Jul 1, 2025•9•0•74

KQL Query

Microsoft Sentinel (KQL)

Tags

T1078 - Valid Accounts T1078.004 - Cloud Accounts T1539 - Steal Web Session Cookie T1190 - Exploit Public-Facing Application TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0006 - Credential Access T1595.002 - Vulnerability Scanning M1016 - Vulnerability Scanning T1588.006 - Vulnerabilities T1651 - Cloud Administration Command T1675 - ESXi Administration Command T1609 - Container Administration Command TA0043 - Reconnaissance TA0042 - Resource Development TA0002 - Execution Vulnerability Scan Detected Credential Access Exploit Attempt Azure Windows Azure Monitor Logs Windows Defender Atpkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?