Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Detecting Windows Downdate Abuse

Steven Lim@KQLWizard

•updated Jul 1, 2025•4•0•32

KQL Query from file: Detecting Windows Downdate Abuse

Microsoft Sentinel (KQL)

Tags

T1078 - Valid Accounts T1543 - Create or Modify System Process T1562 - Impair Defenses T1218 - System Binary Proxy Execution TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access T1036 - Masquerading T1027 - Obfuscated Files or Information T1059 - Command and Scripting Interpreter T1574 - Hijack Execution Flow TA0002 - Execution File Creation File Event Windows Windows Defender Atpkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?