Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Tracking Proton66 Activity with KQL

Steven Lim@KQLWizard

•updated Jul 1, 2025•2•0•38

KQL Query from file: Tracking Proton66 Activity with KQL

Microsoft Sentinel (KQL)

Tags

S0279 - Proton T1071.001 - Web Protocols T1071.004 - DNS T1071.002 - File Transfer Protocols T1056.004 - Credential API Hooking T1558.004 - AS-REP Roasting T1179 - Hooking T1125 - Video Capture T1206 - Sudo Caching TA0011 - Command and Control TA0009 - Collection TA0006 - Credential Access TA0003 - Persistence TA0004 - Privilege Escalation Network Connection Network Connection Outbound Windows Windows Defender Atpkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?