Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Global Admin Entra Cookie with Chrome ZeroDay

Steven Lim@KQLWizard

•updated Jul 1, 2025•7•1•103

KQL Query from file: Global Admin Entra Cookie with Chrome ZeroDay

Microsoft Sentinel (KQL)

Tags

C0036 - Pikabot Distribution February 2024 C0028 - 2015 Ukraine Electric Power Attack C0045 - ShadowRay S0667 - Chrommme T1137.004 - Outlook Home Page T1176.001 - Browser Extensions T1651 - Cloud Administration Command T1675 - ESXi Administration Command T1609 - Container Administration Command C0039 - Versa Director Zero Day Exploitation S0230 - ZeroT T1102.003 - One-Way Communication T1539 - Steal Web Session Cookie T1078.004 - Cloud Accounts T1078 - Valid Accounts T1189 - Drive-by Compromise T1203 - Exploitation for Client Execution TA0003 - Persistence TA0002 - Execution TA0011 - Command and Control TA0006 - Credential Access TA0005 - Defense Evasion TA0004 - Privilege Escalation TA0001 - Initial Access Process Event Credential Access Exploit Attempt Windows Azure Windows Defender Atp Azure Activity Logs Azure Signin Logskql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?