Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Identity Blast Radius 2

Steven Lim@KQLWizard

•updated Jul 1, 2025•2•0•57

KQL Query from file: Identity Blast Radius 2

Microsoft Sentinel (KQL)

Tags

T1078 - Valid Accounts T1078.001 - Default Accounts T1078.002 - Domain Accounts T1078.003 - Local Accounts T1078.004 - Cloud Accounts T1059 - Command and Scripting Interpreter T1087 - Account Discovery T1110 - Brute Force TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0002 - Execution TA0007 - Discovery TA0006 - Credential Access Credential Access Logon Event User Account Modified Authentication Success Authentication Failure Authentication Attempt Command Execution Script Execution Azure Windows Azure Sentinel Azure Ad Risk Detection Active Directory Domain Serviceskql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?