Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Critical Identities Privilege Escalation on Entra Service Principal

Steven Lim@KQLWizard

•updated Jul 1, 2025•5•0•86

KQL Query

Microsoft Sentinel (KQL)

Tags

T1078.004 - Cloud Accounts T1098 - Account Manipulation T1078 - Valid Accounts TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access T1589.001 - Credentials DS0019 - Service T1214 - Credentials in Registry T1102 - Web Service T1047 - Windows Management Instrumentation M1018 - User Account Management T1021.006 - Windows Remote Management T1137.006 - Add-ins T1098.001 - Additional Cloud Credentials TA0043 - Reconnaissance TA0006 - Credential Access TA0011 - Command and Control TA0002 - Execution TA0008 - Lateral Movement Credential Access Cloud Api Call Admin Activity User Account Modified Credential Dumping Logon Event Azure Saas Application Azure Activity Logs Azure Signin Logs Azure Monitor Logs Azure Sentinel M365 Unified Audit Logkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?