Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Detecting Copilot Studio Bot Creation

Steven Lim@KQLWizard

•updated Jul 1, 2025•6•0•53

KQL Query from file: Detecting Copilot Studio Bot Creation

Microsoft Sentinel (KQL)

Tags

T1078 - Valid Accounts T1087 - Account Discovery T1098 - Account Manipulation TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0007 - Discovery DS0019 - Service T1102 - Web Service T1501 - Systemd Service S0177 - Power Loader T1653 - Power Settings T1583.003 - Virtual Private Server T1078.004 - Cloud Accounts T1586.003 - Cloud Accounts T1585.003 - Cloud Accounts T1527 - Application Access Token T1528 - Steal Application Access Token T1550.001 - Application Access Token TA0011 - Command and Control TA0042 - Resource Development TA0008 - Lateral Movement TA0006 - Credential Access Cloud Api Call Admin Activity Service Created Azure Saas Application M365 Unified Audit Logkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?