Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Detecting Nation-State Threat Actors with Custom KQL Queries

Steven Lim@KQLWizard

•updated Jul 1, 2025•3•0•75

KQL Query

Microsoft Sentinel (KQL)

Tags

T1078 - Valid Accounts T1049 - System Network Connections Discovery TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0007 - Discovery M1040 - Behavior Prevention on Endpoint M1049 - Antivirus/Antimalware T1497 - Virtualization/Sandbox Evasion T1562.008 - Disable or Modify Cloud Logs T1070.001 - Clear Windows Event Logs T1654 - Log Enumeration Authentication Attempt Network Connection Credential Access Logon Event Azure Azure Signin Logs Azure Sentinel Azure Ad Risk Detectionkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?