Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Azure Cloud Security Monitoring

Steven Lim@KQLWizard

•updated Jul 1, 2025•14•1•236

KQL Query from file: Azure Cloud Security Monitoring

Microsoft Sentinel (KQL)

Tags

T1530 - Data from Cloud Storage T1583.003 - Virtual Private Server T1562.004 - Disable or Modify System Firewall T1078.004 - Cloud Accounts T1110.003 - Password Spraying T1071.004 - DNS TA0009 - Collection TA0042 - Resource Development TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0006 - Credential Access TA0011 - Command and Control T1110.002 - Password Cracking T1555.005 - Password Managers T1068 - Exploitation for Privilege Escalation T1078.003 - Local Accounts T1106 - Native API T1059.009 - Cloud API TA0002 - Execution Cloud Storage Access Cloud Storage Modification Cloud Api Call Network Connection DNS Query Credential Access Authentication Attempt User Account Modified Azure Azure Activity Logs Azure Monitor Logs Azure Sentinelkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?