Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

BadSuccessor Detection

Steven Lim@KQLWizard

•updated Jul 1, 2025•5•0•102

KQL Query from file: BadSuccessor Detection

Microsoft Sentinel (KQL)

Tags

T1068 - Exploitation for Privilege Escalation TA0004 - Privilege Escalation T1200 - Hardware Additions T1210 - Exploitation of Remote Services T1611 - Escape to Host T1078.003 - Local Accounts DS0026 - Active Directory M1015 - Active Directory Configuration T1547.014 - Active Setup T1558.003 - Kerberoasting TA0001 - Initial Access TA0008 - Lateral Movement TA0005 - Defense Evasion TA0003 - Persistence TA0006 - Credential Access Registry Value Set Registry Key Create Registry Event Authentication Attempt Credential Access Logon Event User Account Modified Admin Activity Windows Active Directory Domain Services Windows Eventlog Securitykql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?